Swift Website Updates & Maintenance https://swiftupdates.ca Swift Website Updates | Wordpress Support Thu, 02 Jul 2026 18:38:36 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://swiftupdates.ca/wp-content/uploads/2022/11/Screen-Shot-2022-11-10-at-1.41.01-PM.png Swift Website Updates & Maintenance https://swiftupdates.ca 32 32 Wordfence Intelligence Weekly WordPress Vulnerability Report (June 22, 2026 to June 28, 2026) https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-june-22-2026-to-june-28-2026/ Thu, 02 Jul 2026 18:38:36 +0000 https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-june-22-2026-to-june-28-2026/ Last week, there were 199 vulnerabilities disclosed in 169 WordPress Plugins and 9 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 111 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 148
Unpatched 51

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Low Severity 1
Medium Severity 143
High Severity 49
Critical Severity 6

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 53
Missing Authorization 52
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 29
Cross-Site Request Forgery (CSRF) 15
Exposure of Sensitive Information to an Unauthorized Actor 9
Authorization Bypass Through User-Controlled Key 8
Deserialization of Untrusted Data 6
Server-Side Request Forgery (SSRF) 5
Unrestricted Upload of File with Dangerous Type 5
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 3
Improper Control of Generation of Code (‘Code Injection’) 3
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 3
Incorrect Privilege Assignment 3
Weak Password Recovery Mechanism for Forgotten Password 2
External Control of File Name or Path 1
Improper Privilege Management 1
Insufficient Verification of Data Authenticity 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

14

11

6

6

6

5

5

5

5

4

4

4

4

3

3

3

3

3

2

2

2

2

2

2

2

2

2
f53fb061b2b39c3b94e35c3f1ba9c31a
lb

2

2

2

2

2

2

2

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1
b1c4c306fad16439d9178a0d349f0c40
L4m

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
24liveblog – live blog tool 24liveblog
Abandoned Cart Lite for WooCommerce woocommerce-abandoned-cart
AdRotate Banner Manager adrotate
Advance Nav Menu Manager advance-nav-menu-manager
Advance Product Search- Voice & Ajax Search for WooCommerce th-advance-product-search
Advanced Contact Form 7 – Compact DB advanced-contact-form-7-compact-db
Advanced Order Export For WooCommerce woo-order-export-lite
Affiliates Manager affiliates-manager
AI Share & Summarize ai-share-summarize
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments
ARforms arforms
Assistio assistio
Auros Core auros-core
Avalon23 Products Filter for WooCommerce avalon23-products-filter-for-woocommerce
BitFire Security – Firewall, Malware Scanner, Bot Blocker, Login Protection bitfire
Block for Mailchimp – Add Email Subscription Forms and Collect Leads block-for-mailchimp
Blocksy Companion Pro blocksy-companion-pro
Blog2Social: Social Media Auto Post & Scheduler blog2social
Blue Captcha blue-captcha
BNE Testimonials bne-testimonials
Book a Room Event Calendar book-a-room-event-calendar
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment booking-and-rental-manager-for-woocommerce
BookPro – Appointment Booking WordPress Plugin ovabookpro
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools woocommerce-jetpack
Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder
BuddyBoss Platform buddyboss-platform
Bulk SEO Image bulk-seo-image
Child Theme Wizard child-theme-wizard
Cincopa video and media plug-in video-playlist-and-gallery-plugin
ClearSale Total clearsale-total
CodePeople Post Map for Google Maps codepeople-post-map
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe contest-gallery
Cornerstone cornerstone
CorvusPay WooCommerce Payment Gateway corvuspay-woocommerce-integration
Customer Reviews for WooCommerce customer-reviews-woocommerce
Devs Accounting – Simple Accounting and Invoicing Solution devs-accounting
Dokan Pro dokan-pro
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy dokan-lite
Donation Thermometer donation-thermometer
Eagle Booking eagle-booking
Elementor Website Builder – more than just a page builder elementor
Email JavaScript Cloak email-javascript-cloaker
Email Marketing for WooCommerce by Omnisend omnisend-connect
EntreDroppers entredropper
EventPrime – Events Calendar, Bookings and Tickets eventprime-event-calendar-management
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI everest-forms
Exclusive Addons for Elementor exclusive-addons-for-elementor
Featured Image featured-image
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution fluent-booking
Forget About Shortcode Buttons forget-about-shortcode-buttons
Forminator Forms – Contact Form, Payment Form & Custom Form Builder forminator
FOX – Currency Switcher Professional for WooCommerce woocommerce-currency-switcher
Frisbii Pay reepay-checkout-gateway
Frontend File Manager Plugin nmedia-user-file-uploader
FunnelKit Payment Gateway for Stripe WooCommerce funnelkit-stripe-woo-payment-gateway
FunnelKit – Funnel Builder for WooCommerce Checkout funnel-builder
Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress gallery-plugin
Generate Security.txt generate-security-txt
GetGenie – AI Content Writer with Keyword Research & SEO Tracking getgenie
Ghost Kit – Page Builder Blocks, Motion Effects & Extensions ghostkit
GIFT4U – Gift Cards All in One for Woo gift4u-gift-cards-all-in-one-for-woo
Gmail SMTP gmail-smtp
Goya Core goya-core
Gravity Bookings gf-bookings-premium
GravityView gravityview
Groundhogg — CRM, Newsletters, and Marketing Automation groundhogg
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns essential-blocks
Gutenverse Form – Contact Form Builder, Block Form & Booking Form gutenverse-form
Gutenverse – WordPress Blocks, Page Builder & Site Editor gutenverse
HD Quiz hd-quiz
Hester Core hester-core
HTML5 Video Player – Embed and Play Videos in Custom Player html5-video-player
Image Carousel image-carousel
Image Sizes on Demand image-sizes-on-demand
Infility Global infility-global
Interactive Content – H5P h5p
Invoice Generator invoice-creator
Ivory Search – WordPress Search Plugin add-search-to-menu
JetEngine jet-engine
JetSmartFilters jet-smart-filters
JS Help Desk – AI-Powered Support & Ticketing System js-support-ticket
Kargo Takip kargo-takip
Kirki – Freeform Page Builder, Website Builder & Customizer kirki
Library Management System library-management-system
Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator live-copy-paste
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid magazine-blocks
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites mainwp-child
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin majestic-support
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates learning-management-system
MasterStudy LMS WordPress Plugin – for Online Courses and Education masterstudy-lms-learning-management-system
MaxButtons – Create buttons maxbuttons
MIR blocks and shortcodes mir-blocks-and-shortcodes
MotorDesk motordesk
Motors – Car Dealership & Classified Listings Plugin motors-car-dealership-classified-listings
MP Customize Login Page mp-customize-login-page
Nelio Content – Editorial Calendar & Social Media Auto-Posting nelio-content
Newsletters newsletters-lite
NEX-Forms – Ultimate Forms Plugin for WordPress nex-forms-express-wp-form-builder
OMGF Pro host-google-fonts-pro
Osiris Signature Banner osiris-signature-banner
Page Builder by SiteOrigin siteorigin-panels
Paid Memberships Pro – Add Member From Admin pmpro-add-member-admin
Panorama – 360 degree Virtual Tour, Panoramic Image viewer and More panorama
Payment Gateway Based Fees and Discounts for WooCommerce checkout-fees-for-woocommerce
Paytium: Mollie payment forms & donations paytium
Perfmatters perfmatters
Pie Register – User Registration, Profiles & Content Restriction pie-register
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups ays-popup-box
Post Duplicator post-duplicator
Post Snippets – Custom WordPress Code Snippets Customizer post-snippets
PPOM – Product Addons & Custom Fields for WooCommerce woocommerce-product-addon
PPWP – Password Protect Pages password-protect-page
Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes
Product Specifications for Woocommerce product-specifications
ProfileGrid – User Profiles, Groups and Communities profilegrid-user-profiles-groups-and-communities
Quform – WordPress Form Builder quform
Quick Interest Slider quick-interest-slider
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker quiz-master-next
Quotes llama quotes-llama
Recipe Cards For Your Food Blog from Zip Recipes zip-recipes
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login custom-registration-form-builder-with-submission-manager
RentMy Real-Time Rental Management Plugin rentmy-online-rental-shop
Responsive Lightbox & Gallery responsive-lightbox
Restaurant Menu and Food Ordering mp-restaurant-menu
Reviews and Rating – Docplanner reviews-and-rating-docplanner
SearchPlus searchplus
Secufor_OAuth wpoauth
SeedProd Pro seedprod-coming-soon-pro-5
SEOPress PRO wp-seopress-pro
Shoppable Images (Lookbook) for WooCommerce mabel-shoppable-images-lite
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization shortpixel-adaptive-images
SignUp & SignIn signup-signin
Simple Basic Contact Form simple-basic-contact-form
Site Kit by Google – Analytics, Search Console, AdSense, Speed google-site-kit
Site Reviews site-reviews
SiteGround Email Marketing siteground-email-marketing
Slim SEO – A Fast & Automated SEO Plugin For WordPress slim-seo
StatCounter – Free Real Time Visitor Stats official-statcounter-plugin-for-wordpress
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions wp-full-stripe-free
Subscriptions for WooCommerce subscriptions-for-woocommerce
Surbma | Infusionsoft Shortcode surbma-infusionsoft-shortcode
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments surecart
TablePress – Tables in WordPress made easy tablepress
TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder templatespare
Toolset Forms cred-frontend-editor
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin tourfic
Transbank Webpay transbank-webpay-plus-rest
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimate-member
Uncanny Automator Pro uncanny-automator-pro
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin uncanny-automator
URL Preview link-preview
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder user-registration
utm.codes utm-dot-codes
WCBoost – Products Compare wcboost-products-compare
Welcome Software Publishing newscred-publishing
weMail – Email Marketing, Newsletter Builder & Email Automations for WooCommerce wemail
WhatsOrder – Instant Checkout for WooCommerce whatsorder-instant-checkout-for-woocommerce
WordPress Automatic Plugin wp-automatic
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets wp-all-import
WP Forms Connector wp-forms-connector
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website wp-job-portal
WP Latest Posts wp-latest-posts
WP Meta SEO wp-meta-seo
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars wp-post-author
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System wp-cafe
WPComplete wpcomplete
wpForo Forum wpforo
Xpro Addons — 140+ Widgets for Elementor xpro-elementor-addons
워드프레스 결제 심플페이 – 우커머스 결제 플러그인 pgall-for-woocommerce

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
ListingPro – WordPress Directory & Listing Theme listingpro
NanoMag – Responsive WordPress Magazine Theme nanomag
Neve PRO neve-pro-addon
Real Estate 7 WordPress realestate-7
RH – Real Estate WordPress Theme realhomes
Spexo spexo
splash splash
Travel Booking travel-booking
Woodmart woodmart

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Dokan Pro <= 5.0.4 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-56033
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

Dokan Pro [dokan-pro]

Researcher

More Details >

Invoice Generator <= 1.0.0 – Unauthenticated Account Takeover via Weak Password Reset Validation via ‘reset_user_id’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-12416
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Invoice Generator [invoice-creator]

Researcher

More Details >

Invoice Generator <= 1.0.0 – Unauthenticated Privilege Escalation via Account Takeover via ‘user_id’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-12415
Patch Status
Unpatched
Published
Jun 26, 2026

Affected Software

Invoice Generator [invoice-creator]

Researcher

More Details >

OMGF Pro <= 5.2.6 – Unauthenticated Arbitrary File Upload via @import URL Reflection

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-57700
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

OMGF Pro [host-google-fonts-pro]

Researchers

More Details >

Paytium: Mollie payment forms & donations <= 5.0.2 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-56030
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

Paytium: Mollie payment forms & donations [paytium]

Researcher

More Details >

SignUp & SignIn <= 1.0.0 – Unauthenticated Privilege Escalation via Weak Password Reset Validation via ‘reset_activation_code’ Leading to Account Takeover

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-12417
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

SignUp & SignIn [signup-signin]

Researcher

More Details >

AdRotate Banner Manager <= 5.17.7 – Authenticated (Contributor+) PHP Code Injection via ‘banner’ Shortcode Attribute

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-12242
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

AdRotate Banner Manager [adrotate]

Researcher

More Details >

Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools <= 8.0.1 – Authenticated (Customer+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-56027
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools [woocommerce-jetpack]

Researcher

More Details >

Frisbii Pay <= 1.8.2 – Authenticated (Contributor+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-56038
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Frisbii Pay [reepay-checkout-gateway]

Researcher

More Details >

JS Help Desk – AI-Powered Support & Ticketing System <= 3.1.1 – Authenticated (Subscriber+) Arbitrary File Deletion

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-56054
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

JS Help Desk – AI-Powered Support & Ticketing System [js-support-ticket]

Researcher

More Details >

Post Snippets – Custom WordPress Code Snippets Customizer <= 4.0.19 – Authenticated (Contributor+) Remote Code Execution

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-56049
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Post Snippets – Custom WordPress Code Snippets Customizer [post-snippets]

Researcher

More Details >

Quform – WordPress Form Builder <= 2.23.0 – Authenticated (Subscriber+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-56058
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Quform – WordPress Form Builder [quform]

Researcher

More Details >

Ultimate Member <= 2.11.4 – Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-7761
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member]

Researcher

More Details >

Welcome Software Publishing <= 0.0.31 – Authenticated (Subscriber+) Arbitrary Options Update to Privilege Escalation via ‘nc.setOption’ XML-RPC Method

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-4297
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Welcome Software Publishing [newscred-publishing]

Researcher

More Details >

Frontend File Manager Plugin <= 23.6 – Authenticated (Subscriber+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-8095
Patch Status
Unpatched
Published
Jun 27, 2026

Affected Software

Frontend File Manager Plugin [nmedia-user-file-uploader]

Researcher

More Details >

Interactive Content – H5P <= 1.17.7 – Authenticated (Contributor+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-57321
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Interactive Content – H5P [h5p]

Researcher

More Details >

Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.3.1.2 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-56031
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin [uncanny-automator]

Researcher

More Details >

Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-56070
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Advance Product Search- Voice & Ajax Search for WooCommerce [th-advance-product-search]

Researcher

More Details >

BuddyBoss Platform <= 3.0.4 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-56032
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

BuddyBoss Platform [buddyboss-platform]

Researcher

More Details >

ClearSale Total <= 3.4.2 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-8705
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

ClearSale Total [clearsale-total]

Researcher

More Details >

Dokan Pro <= 5.0.4 – Unauthenticated SQL Injection via ‘latitude’ and ‘longitude’ Parameters

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-12077
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Dokan Pro [dokan-pro]

Researcher

f53fb061b2b39c3b94e35c3f1ba9c31alb

More Details >

EventPrime – Events Calendar, Bookings and Tickets <= 4.3.4.1 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-56053
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

EventPrime – Events Calendar, Bookings and Tickets [eventprime-event-calendar-management]

Researcher

More Details >

Goya Core < 1.0.9.4 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2025-68064
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Goya Core [goya-core]

Researcher

More Details >

JetEngine <= 3.8.10.2 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-56068
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

JetSmartFilters <= 3.8.3 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-56067
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

JetSmartFilters [jet-smart-filters]

Researcher

More Details >

Library Management System <= 3.5.7 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-56034
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

Library Management System [library-management-system]

Researcher

More Details >

Panorama – 360 degree Virtual Tour, Panoramic Image viewer and More <= 1.6.1 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-57647
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Panorama – 360 degree Virtual Tour, Panoramic Image viewer and More [panorama]

Researcher

More Details >

Post Duplicator < 3.0.15 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-10749
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Post Duplicator [post-duplicator]

Researcher

More Details >

Quotes llama <= 3.1.5 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-56062
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Quotes llama [quotes-llama]

Researcher

More Details >

RH – Real Estate WordPress Theme <= 4.5.3 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-56055
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

RH – Real Estate WordPress Theme [realhomes]

Researcher

More Details >

Splash – Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2025-68063
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

splash [splash]

Researcher

More Details >

Tourfic <= 2.22.7 – Unauthenticated SQL Injection via ‘post_id’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-12937
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin [tourfic]

Researcher

More Details >

Uncanny Automator Pro <= 7.3.0.6 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-56057
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Uncanny Automator Pro [uncanny-automator-pro]

Researcher

More Details >

WP Forms Connector <= 1.8 – Missing Authorization to Unauthenticated Information Exposure via ‘user/list’ REST Endpoint

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-9178
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

WP Forms Connector [wp-forms-connector]

Researcher

More Details >

WP Forms Connector <= 1.8 – Unauthenticated SQL Injection via ‘order’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-9179
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

WP Forms Connector [wp-forms-connector]

Researcher

More Details >

워드프레스 결제 심플페이 – 우커머스 결제 플러그인 <= 5.5.6 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-56036
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

워드프레스 결제 심플페이 – 우커머스 결제 플러그인 [pgall-for-woocommerce]

Researcher

More Details >

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57317
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin [simply-schedule-appointments]

Researcher

More Details >

ARForms <= 7.1.3 – Unauthenticated Stored Cross-Site Scripting via ‘value’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-3652
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

ARforms [arforms]

Researcher

More Details >

Blog2Social: Social Media Auto Post & Scheduler <= 8.9.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-56044
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Blog2Social: Social Media Auto Post & Scheduler [blog2social]

Researcher

More Details >

Cincopa video and media plug-in <= 1.163 – Unauthenticated Stored Cross-Site Scripting via cincopa Shortcode in Post Comments

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-10092
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Cincopa video and media plug-in [video-playlist-and-gallery-plugin]

Researcher

More Details >

Customer Reviews for WooCommerce <= 5.110.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-56043
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Customer Reviews for WooCommerce [customer-reviews-woocommerce]

Researcher

More Details >

Email JavaScript Cloak <= 1.03 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-10091
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Email JavaScript Cloak [email-javascript-cloaker]

Researcher

More Details >

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.53.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-56071
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

FOX – Currency Switcher Professional for WooCommerce <= 1.4.8 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57319
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

FOX – Currency Switcher Professional for WooCommerce [woocommerce-currency-switcher]

Researcher

More Details >

Gutenverse Form – Contact Form Builder, Block Form & Booking Form <= 2.4.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-56040
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Gutenverse Form – Contact Form Builder, Block Form & Booking Form [gutenverse-form]

Researcher

More Details >

Kargo Takip <= 1.2 – Unauthenticated Server-Side Request Forgery via ‘api_url’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-12095
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Kargo Takip [kargo-takip]

Researcher

More Details >

NanoMag <= 1.8 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57325
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

NanoMag – Responsive WordPress Magazine Theme [nanomag]

Researcher

More Details >

Responsive Lightbox & Gallery <= 2.7.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-56041
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Responsive Lightbox & Gallery [responsive-lightbox]

Researcher

More Details >

Simple Basic Contact Form <= 20250114 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-8172
Patch Status
Unpatched
Published
Jun 25, 2026

Affected Software

Simple Basic Contact Form [simple-basic-contact-form]

Researcher

More Details >

TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder <= 4.2.0 – Authenticated (Admin+) Arbitrary File Upload

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-57658
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder [templatespare]

Researcher

More Details >

Transbank Webpay < 1.14.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-6858
Patch Status
Patched
Published
Jun 22, 2026

Affected Software

Transbank Webpay [transbank-webpay-plus-rest]

Researcher

More Details >

URL Preview <= 1.0 – Unauthenticated Server-Side Request Forgery via ‘url’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-12100
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

URL Preview [link-preview]

Researcher

More Details >

Woodmart <= 8.5.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-56072
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Woodmart [woodmart]

Researcher

More Details >

WordPress Automatic Plugin < 3.135.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-56045
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

WordPress Automatic Plugin [wp-automatic]

Researcher

More Details >

WP Meta SEO <= 4.5.18 – Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Logging

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-9643
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

WP Meta SEO [wp-meta-seo]

Researcher

More Details >

Auros Core <= 5.3.1 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2025-64637
Patch Status
Unpatched
Published
Jun 26, 2026

Affected Software

Auros Core [auros-core]

Researcher

More Details >

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 30.0.0 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57662
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]

Researcher

More Details >

Dokan Pro <= 5.0.4 – Authenticated (Subscriber+) SQL Injection via ‘orderby’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-12079
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Dokan Pro [dokan-pro]

Researcher

f53fb061b2b39c3b94e35c3f1ba9c31alb

More Details >

Frisbii Pay <= 1.8.9 – Missing Authorization to Authenticated (Subscriber+) Payment Token Modification

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-3462
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Frisbii Pay [reepay-checkout-gateway]

Researcher

More Details >

Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress <= 4.7.8 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57642
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress [gallery-plugin]

Researcher

More Details >

Gravity Forms Booking <= 2.7.1 – Authenticated (Subscriber+) Time-Based SQL Injection via ‘staff_id’

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-2508
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Gravity Bookings [gf-bookings-premium]

Researcher

More Details >

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5 – Authenticated (Sales representative+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57667
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researcher

More Details >

Groundhogg <= 4.5.4 – Authenticated (Custom+) SQL Injection via ‘after’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-13226
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researcher

More Details >

Groundhogg <= 4.5.5 – Authenticated (Marketer+) SQL Injection via ‘search’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-13331
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researchers

More Details >

Groundhogg <= 4.5.5 – Authenticated (Sales Rep+) SQL Injection via ‘query[select]’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-13333
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researchers

More Details >

Infility Global < 2.15.19 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-8163
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Infility Global [infility-global]

Researcher

More Details >

Recipe Cards For Your Food Blog from Zip Recipes <= 8.2.7 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57663
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Recipe Cards For Your Food Blog from Zip Recipes [zip-recipes]

Researcher

More Details >

Restaurant Menu and Food Ordering <= 2.4.10 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57644
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Restaurant Menu and Food Ordering [mp-restaurant-menu]

Researcher

More Details >

Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-56064
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin [tourfic]

Researcher

More Details >

User Registration & Membership <= 5.2.0 – Missing Authorization to Unauthenticated Payment Bypass

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-1869
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]

Researcher

More Details >

WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.2 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57653
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

WP Job Portal – AI-Powered Recruitment System for Company or Job Board website [wp-job-portal]

Researcher

More Details >

WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars <= 3.9.1 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57643
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars [wp-post-author]

Researcher

More Details >

wpForo Forum <= 3.0.9 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-57636
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

wpForo Forum [wpforo]

Researcher

More Details >

Advanced Order Export For WooCommerce <= 4.0.9 – Authenticated (Customer+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-56042
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Advanced Order Export For WooCommerce [woo-order-export-lite]

Researcher

More Details >

AI Share & Summarize < 2.0.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-10531
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

AI Share & Summarize [ai-share-summarize]

Researcher

More Details >

Avalon23 Products Filter for WooCommerce <= 1.1.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8865
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Avalon23 Products Filter for WooCommerce [avalon23-products-filter-for-woocommerce]

Researcher

More Details >

BNE Testimonials <= 2.0.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2025-68075
Patch Status
Unpatched
Published
Jun 26, 2026

Affected Software

BNE Testimonials [bne-testimonials]

Researcher

More Details >

CodePeople Post Map for Google Maps <= 1.2.6 – Authenticated (Contributor +) Stored Cross-Site Scripting via ‘cpm_point’ Post Meta

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-13335
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

CodePeople Post Map for Google Maps [codepeople-post-map]

Researchers

More Details >

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 – Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-11783
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite]

Researcher

More Details >

Exclusive Addons for Elementor <= 2.7.9.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57620
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Exclusive Addons for Elementor [exclusive-addons-for-elementor]

Researcher

More Details >

Featured Image <= 2.1 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57431
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Featured Image [featured-image]

Researcher

More Details >

Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 2.1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57638
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution [fluent-booking]

Researcher

More Details >

Frontend File Manager Plugin <= 23.6 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8378
Patch Status
Unpatched
Published
Jun 25, 2026

Affected Software

Frontend File Manager Plugin [nmedia-user-file-uploader]

Researcher

More Details >

Ghost Kit – Page Builder Blocks, Motion Effects & Extensions <= 3.6.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57651
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Ghost Kit – Page Builder Blocks, Motion Effects & Extensions [ghostkit]

Researcher

More Details >

Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 6.1.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘configurablePrefix’ Block Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-10833
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns [essential-blocks]

Researcher

More Details >

Hester Core <= 1.1.8 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57656
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Hester Core [hester-core]

Researcher

More Details >

Image Carousel <= 1.0.0.41 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2025-68074
Patch Status
Unpatched
Published
Jun 26, 2026

Affected Software

Image Carousel [image-carousel]

Researcher

More Details >

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 – Authenticated (Subscriber+) Server-Side Request Forgery

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57627
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

More Details >

ListingPro – WordPress Directory & Listing Theme <= 2.9.11 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-56046
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

ListingPro – WordPress Directory & Listing Theme [listingpro]

Researcher

More Details >

Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid <= 1.8.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57650
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid [magazine-blocks]

Researcher

More Details >

MIR blocks and shortcodes <= 1.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8896
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

MIR blocks and shortcodes [mir-blocks-and-shortcodes]

Researcher

More Details >

Neve PRO <= 3.1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57618
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Neve PRO [neve-pro-addon]

Researcher

More Details >

Page Builder by SiteOrigin <= 2.34.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via panels_data Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-13295
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Page Builder by SiteOrigin [siteorigin-panels]

Researcher

More Details >

ProfileGrid <= 5.9.9.2 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-4610
Patch Status
Patched
Published
Jun 22, 2026

Affected Software

ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities]

Researcher

More Details >

SeedProd Pro < 6.19.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57617
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

SeedProd Pro [seedprod-coming-soon-pro-5]

Researcher

More Details >

StatCounter – Free Real Time Visitor Stats <= 2.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57629
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

StatCounter – Free Real Time Visitor Stats [official-statcounter-plugin-for-wordpress]

Researcher

More Details >

Surbma | Infusionsoft Shortcode <= 2.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-11597
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Surbma | Infusionsoft Shortcode [surbma-infusionsoft-shortcode]

Researcher

More Details >

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.2.2 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-57313
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]

Researcher

More Details >

utm.codes <= 1.9.0 – Authenticated (Subscriber+) Server-Side Request Forgery

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-56026
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

utm.codes [utm-dot-codes]

Researcher

More Details >

WP Latest Posts <= 5.0.11 – Authenticated (Author+) Stored Cross-Site Scripting via Post Content Image src Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-9620
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

WP Latest Posts [wp-latest-posts]

Researcher

More Details >

WP Meta SEO <= 4.5.18 – Authenticated (Contributor+) Server-Side Request Forgery via ‘new_link’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-11370
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

WP Meta SEO [wp-meta-seo]

Researcher

More Details >

Xpro Addons <= 1.7.2 – Authenticated (Author+) Stored Cross-Site Scripting via ‘custom_attributes’ Parameter of Multiple Widgets

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-11614
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

Xpro Addons — 140+ Widgets for Elementor [xpro-elementor-addons]

Researcher

More Details >

EntreDroppers <= 1.1.2 – Reflected Cross-Site Scripting via PHP_SELF Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-8628
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

EntreDroppers [entredropper]

Researcher

More Details >

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.4.8 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-57312
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms]

Researcher

More Details >

Image Sizes on Demand <= 1.3 – Reflected Cross-Site Scripting via PHP_SELF Server Variable

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-8622
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Image Sizes on Demand [image-sizes-on-demand]

Researcher

More Details >

MaxButtons <= 9.8.5 – Reflected Cross-Site Scripting via ‘view’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-13245
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

MaxButtons – Create buttons [maxbuttons]

Researcher

More Details >

Osiris Signature Banner <= 0.5 – Cross-Site Request Forgery to Stored Cross-Site Scripting via ‘prepend_text’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-8905
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Osiris Signature Banner [osiris-signature-banner]

Researcher

More Details >

Perfmatters <= 2.6.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-56047
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Perfmatters [perfmatters]

Researcher

More Details >

Quick Interest Slider <= 3.1.6 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-56039
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

Quick Interest Slider [quick-interest-slider]

Researcher

More Details >

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.3.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-57314
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]

Researcher

More Details >

TablePress – Tables in WordPress made easy <= 3.3.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-56051
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

TablePress – Tables in WordPress made easy [tablepress]

Researcher

More Details >

weMail – Email Marketing, Newsletter Builder & Email Automations for WooCommerce <= 2.1.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-57322
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

weMail – Email Marketing, Newsletter Builder & Email Automations for WooCommerce [wemail]

Researcher

More Details >

Advanced Contact Form 7 <= 1.0.0 – Missing Authorization to Unauthenticated Arbitrary Contact Form Submission Deletion via ‘form_id’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12094
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Advanced Contact Form 7 – Compact DB [advanced-contact-form-7-compact-db]

Researcher

More Details >

BitFire Security – Firewall, Malware Scanner, Bot Blocker, Login Protection <= 5.0.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56035
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

BitFire Security – Firewall, Malware Scanner, Bot Blocker, Login Protection [bitfire]

Researcher

More Details >

Block for Mailchimp – Add Email Subscription Forms and Collect Leads <= 1.1.15 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56063
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Block for Mailchimp – Add Email Subscription Forms and Collect Leads [block-for-mailchimp]

Researcher

More Details >

Blocksy Companion Pro <= 2.1.46 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57630
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Blocksy Companion Pro [blocksy-companion-pro]

Researcher

More Details >

Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57660
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment [booking-and-rental-manager-for-woocommerce]

Researcher

More Details >

BookPro – Appointment Booking WordPress Plugin <= 1.1.0 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2025-66123
Patch Status
Unpatched
Published
Jun 26, 2026

Affected Software

BookPro – Appointment Booking WordPress Plugin [ovabookpro]

Researcher

More Details >

Bopo – WooCommerce Product Bundle Builder <= 1.1.6 – Unauthenticated Sensitive Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57664
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Bopo – WooCommerce Product Bundle Builder [bopo-woo-product-bundle-builder]

Researcher

More Details >

CorvusPay WooCommerce Payment Gateway <= 2.7.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56029
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

CorvusPay WooCommerce Payment Gateway [corvuspay-woocommerce-integration]

Researcher

More Details >

Devs Accounting <= 1.2.0 – Missing Authorization to Unauthenticated Account Deletion via /delete-account/ REST Endpoint

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9172
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Devs Accounting – Simple Accounting and Invoicing Solution [devs-accounting]

Researcher

More Details >

Devs Accounting <= 1.2.0 – Missing Authorization to Unauthenticated Sensitive Information Exposure via ‘id’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9175
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Devs Accounting – Simple Accounting and Invoicing Solution [devs-accounting]

Researcher

More Details >

Donation Thermometer <= 2.2.7 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2025-64636
Patch Status
Unpatched
Published
Jun 26, 2026

Affected Software

Donation Thermometer [donation-thermometer]

Researcher

More Details >

Frontend File Manager Plugin <= 23.6 – Missing Authorization to Unauthenticated File Download

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-8379
Patch Status
Unpatched
Published
Jun 25, 2026

Affected Software

Frontend File Manager Plugin [nmedia-user-file-uploader]

Researcher

More Details >

GIFT4U – Gift Cards All in One for Woo <= 1.0.10 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57324
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

GIFT4U – Gift Cards All in One for Woo [gift4u-gift-cards-all-in-one-for-woo]

Researcher

More Details >

GravityView <= 3.0.0 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57665
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

GravityView [gravityview]

Researcher

More Details >

HTML5 Video Player – Embed and Play Videos in Custom Player <= 2.11.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57323
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

HTML5 Video Player – Embed and Play Videos in Custom Player [html5-video-player]

Researcher

More Details >

JS Help Desk – AI-Powered Support & Ticketing System <= 3.1.0 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57652
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

JS Help Desk – AI-Powered Support & Ticketing System [js-support-ticket]

Researcher

More Details >

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites <= 6.1.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-27366
Patch Status
Patched
Published
Jun 23, 2026

Affected Software

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child]

Researcher

More Details >

NEX-Forms <= 9.2.2 – Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12404
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]

Researcher

More Details >

Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56048
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Payment Gateway Based Fees and Discounts for WooCommerce [checkout-fees-for-woocommerce]

Researcher

More Details >

Pie Register – User Registration, Profiles & Content Restriction < 3.8.4.10 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-10530
Patch Status
Patched
Published
Jun 22, 2026

Affected Software

Pie Register – User Registration, Profiles & Content Restriction [pie-register]

Researcher

More Details >

PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.18 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56050
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

PPOM – Product Addons & Custom Fields for WooCommerce [woocommerce-product-addon]

Researcher

More Details >

Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56060
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Print Invoice & Delivery Notes for WooCommerce [woocommerce-delivery-notes]

Researcher

More Details >

RegistrationMagic <= 6.0.8.6 – Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9242
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]

Researcher

More Details >

RentMy Real-Time Rental Management Plugin <= 4.0.4.1 – Missing Authorization to Unauthenticated Settings Update via rentmy_cdn_request AJAX Action

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-8690
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

RentMy Real-Time Rental Management Plugin [rentmy-online-rental-shop]

Researcher

More Details >

SearchPlus <= 1.7.1 – Missing Authorization to Unauthenticated Settings Modification and Deletion via searchplus_save_token & searchplus_reset_token AJAX Actions

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-8617
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

SearchPlus [searchplus]

Researcher

More Details >

Secufor_OAuth <= 1.0.7 – Missing Authorization to Unauthenticated Account Logout via ‘secuforoauth_unregister_action’ AJAX Action

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-7617
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Secufor_OAuth [wpoauth]

Researcher

More Details >

ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization <= 3.11.4 – Unauthenticated Arbitrary File Deletion

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56066
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization [shortpixel-adaptive-images]

Researcher

More Details >

SiteGround Email Marketing <= 1.7.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-24547
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

SiteGround Email Marketing [siteground-email-marketing]

Researcher

More Details >

Stripe Payment Forms by WP Full Pay <= 8.4.3 – Missing Authorization to Unauthenticated Payment Record Manipulation via ‘paymentIntentId’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12432
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions [wp-full-stripe-free]

Researcher

More Details >

Subscriptions for WooCommerce <= 1.9.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56061
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Subscriptions for WooCommerce [subscriptions-for-woocommerce]

Researcher

More Details >

Toolset Forms <= 2.6.24 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56069
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Toolset Forms [cred-frontend-editor]

Researcher

More Details >

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-52701
Patch Status
Patched
Published
Jun 22, 2026

Affected Software

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]

Researcher

More Details >

WCBoost – Products Compare <= 1.1.0 – Unauthenticated Sensitive Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-57633
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

WCBoost – Products Compare [wcboost-products-compare]

Researcher

More Details >

WhatsOrder <= 1.0.1 – Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLs

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9612
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

WhatsOrder – Instant Checkout for WooCommerce [whatsorder-instant-checkout-for-woocommerce]

Researcher

More Details >

FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.5 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-56052
Patch Status
Patched
Published
Jun 24, 2026

Affected Software

FunnelKit – Funnel Builder for WooCommerce Checkout [funnel-builder]

Researcher

More Details >

Infility Global < 2.15.20 – Authenticated (Editor+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-7842
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Infility Global [infility-global]

Researcher

More Details >

Popup Box – Create Countdown, Coupon, Video, Contact Form Popups <= 6.0.1 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-57631
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Popup Box – Create Countdown, Coupon, Video, Contact Form Popups [ays-popup-box]

Researcher

More Details >

WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets <= 4.0.1 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-57628
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets [wp-all-import]

Researcher

More Details >

Gutenverse <= 3.8.0 – Authenticated (Editor+) Stored Cross-Site Scripting via ‘fonts[].font.font.value’ Parameter

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-12399
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Gutenverse – WordPress Blocks, Page Builder & Site Editor [gutenverse]

Researchers

More Details >

Ivory Search <= 5.5.15 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘menu_title’ and ‘menu_magnifier_color’ Settings

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-11356
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Ivory Search – WordPress Search Plugin [add-search-to-menu]

Researcher

More Details >

24liveblog <= 2.2 – Authenticated (Contributor+) Exposure of Sensitive Information via Block Editor Script Localization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9183
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

24liveblog – live blog tool [24liveblog]

Researcher

More Details >

24liveblog <= 2.2 – Missing Authorization to Authenticated (Author+) Settings Modification via update_lb24_token AJAX action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9184
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

24liveblog – live blog tool [24liveblog]

Researcher

More Details >

Abandoned Cart Lite for WooCommerce <= 6.8.0 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57637
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Abandoned Cart Lite for WooCommerce [woocommerce-abandoned-cart]

Researcher

More Details >

Advance Nav Menu Manager <= 1.3 – Missing Authorization to Authenticated (Subscriber+) Nav Menu Item Modification via anmm_save_menu_data AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8688
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Advance Nav Menu Manager [advance-nav-menu-manager]

Researcher

More Details >

Affiliates Manager <= 2.9.49 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57654
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Affiliates Manager [affiliates-manager]

Researcher

More Details >

Assistio <= 1.1.2 – Missing Authorization to Authenticated (Subscriber+) Plugin Settings Deletion via assistio_plugin_delete_assistio_settings AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8614
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Assistio [assistio]

Researcher

More Details >

Blue Captcha <= 2.0.1 – Cross-Site Request Forgery via ‘blcap_action’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-10552
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Blue Captcha [blue-captcha]

Researcher

More Details >

Book a Room Event Calendar <= 1.9 – Cross-Site Request Forgery to Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9721
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Book a Room Event Calendar [book-a-room-event-calendar]

Researcher

More Details >

Bulk SEO Image <= 1.1 – Cross-Site Request Forgery to Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11997
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Bulk SEO Image [bulk-seo-image]

Researcher

More Details >

Child Theme Wizard <= 1.4 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57655
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Child Theme Wizard [child-theme-wizard]

Researcher

More Details >

Cornerstone < 7.8.8 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9710
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Cornerstone [cornerstone]

Researcher

More Details >

Cornerstone < 7.8.9 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9709
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Cornerstone [cornerstone]

Researcher

More Details >

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 – Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via ‘id’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11987
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite]

Researcher

More Details >

Eagle Booking <= 1.3.4.3 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2025-68052
Patch Status
Unpatched
Published
Jun 26, 2026

Affected Software

Eagle Booking [eagle-booking]

Researcher

More Details >

Elementor Website Builder – more than just a page builder <= 4.1.3 – Authenticated (Contributor+) Sensitive Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57619
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Elementor Website Builder – more than just a page builder [elementor]

Researcher

More Details >

Email Marketing for WooCommerce by Omnisend <= 1.19.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57632
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Email Marketing for WooCommerce by Omnisend [omnisend-connect]

Researcher(s): Unknown

More Details >

Forget About Shortcode Buttons <= 2.1.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2025-63041
Patch Status
Unpatched
Published
Jun 26, 2026

Affected Software

Forget About Shortcode Buttons [forget-about-shortcode-buttons]

Researcher

More Details >

FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57635
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

FunnelKit Payment Gateway for Stripe WooCommerce [funnelkit-stripe-woo-payment-gateway]

Researcher

More Details >

Generate Security.txt <= 1.0.12 – Missing Authorization to Authenticated (Subscriber+) Security.txt Deletion via delete_securitytxt AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9616
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Generate Security.txt [generate-security-txt]

Researcher

More Details >

GetGenie – AI Content Writer with Keyword Research & SEO Tracking <= 4.4.2 – Authenticated (Subscriber+) Sensitive Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57316
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

GetGenie – AI Content Writer with Keyword Research & SEO Tracking [getgenie]

Researcher

More Details >

Gmail SMTP <= 1.2.3.19 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57657
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Gmail SMTP [gmail-smtp]

Researcher

More Details >

HD Quiz 2.2.0 – 2.2.1 – Cross-Site Request Forgery via Multiple AJAX Handlers

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-13422
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

HD Quiz [hd-quiz]

Researcher

More Details >

Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator <= 1.5.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2025-63079
Patch Status
Unpatched
Published
Jun 26, 2026

Affected Software

Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator [live-copy-paste]

Researcher

More Details >

Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.1.7 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57646
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin [majestic-support]

Researcher

More Details >

Masteriyo LMS <= 2.2.1 – Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11773
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]

Researcher

More Details >

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.30 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57640
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

More Details >

MotorDesk <= 1.1.2 – Cross-Site Request Forgery to Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9724
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

MotorDesk [motordesk]

Researcher

More Details >

Motors – Car Dealership & Classified Listings Plugin < 1.4.110 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-7859
Patch Status
Patched
Published
Jun 22, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researcher

More Details >

MP Customize Login Page <= 1.0 – Cross-Site Request Forgery to Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-6292
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

MP Customize Login Page [mp-customize-login-page]

Researcher

More Details >

Nelio Content – Editorial Calendar & Social Media Auto-Posting <= 4.3.4 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57648
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Nelio Content – Editorial Calendar & Social Media Auto-Posting [nelio-content]

Researcher

More Details >

Newsletters <= 4.13 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57645
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Newsletters [newsletters-lite]

Researcher

More Details >

Paid Memberships Pro – Add Member From Admin <= 0.7.2 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57659
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Paid Memberships Pro – Add Member From Admin [pmpro-add-member-admin]

Researcher

More Details >

PPWP – Password Protect Pages <= 1.9.19 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57634
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

PPWP – Password Protect Pages [password-protect-page]

Researcher

More Details >

Product Specifications for Woocommerce <= 0.8.9 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Attribute/Group Creation, Modification, and Deletion via ‘dwps_modify_groups’ and ‘dwps_modify_attributes’ AJAX Actions

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11364
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Product Specifications for Woocommerce [product-specifications]

Researcher

More Details >

Quiz and Survey Master (QSM) <= 11.1.4 – Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9233
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker [quiz-master-next]

Researcher

More Details >

Real Estate 7 WordPress <= 3.5.9 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57641
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Real Estate 7 WordPress [realestate-7]

Researcher

More Details >

Restaurant Menu and Food Ordering <= 2.4.11 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2025-63078
Patch Status
Unpatched
Published
Jun 26, 2026

Affected Software

Restaurant Menu and Food Ordering [mp-restaurant-menu]

Researcher

More Details >

Reviews and Rating <= 1.1.4 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync_reviews AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9619
Patch Status
Unpatched
Published
Jun 23, 2026

Affected Software

Reviews and Rating – Docplanner [reviews-and-rating-docplanner]

Researcher

More Details >

SEOPress PRO <= 9.1.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57430
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

SEOPress PRO [wp-seopress-pro]

Researcher

More Details >

Shoppable Images (Lookbook) for WooCommerce <= 1.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57649
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Shoppable Images (Lookbook) for WooCommerce [mabel-shoppable-images-lite]

Researcher

More Details >

Site Reviews <= 8.0.11 – Authenticated (Subscriber+) Sensitive Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57318
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Site Reviews [site-reviews]

Researcher

More Details >

Slim SEO – A Fast & Automated SEO Plugin For WordPress <= 4.6.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57429
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Slim SEO – A Fast & Automated SEO Plugin For WordPress [slim-seo]

Researcher

More Details >

Spexo <= 2.0.11 – Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12471
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

Spexo [spexo]

Researcher

More Details >

Travel Booking <= 2.2.5 – Authenticated (Subscriber+) Arbitrary File Upload

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-56059
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Travel Booking [travel-booking]

Researcher

More Details >

WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System <= 3.0.14 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57622
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System [wp-cafe]

Researcher

b1c4c306fad16439d9178a0d349f0c40L4m

More Details >

WPComplete <= 2.9.5.5 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-57661
Patch Status
Patched
Published
Jun 26, 2026

Affected Software

WPComplete [wpcomplete]

Researcher

More Details >

Site Kit by Google – Analytics, Search Console, AdSense, Speed < 1.176.0 – Missing Authorization to Authenticated (Editor+) Settings Update

2.7

CVSS Rating
2.7 (Low)
CVE-ID

CVE-2026-10753
Patch Status
Patched
Published
Jun 25, 2026

Affected Software

Site Kit by Google – Analytics, Search Console, AdSense, Speed [google-site-kit]

Researcher

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (June 22, 2026 to June 28, 2026) appeared first on Wordfence.

]]> Wordfence Intelligence Weekly WordPress Vulnerability Report (June 15, 2026 to June 21, 2026) https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-june-15-2026-to-june-21-2026/ Thu, 25 Jun 2026 19:39:41 +0000 https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-june-15-2026-to-june-21-2026/ Last week, there were 146 vulnerabilities disclosed in 127 WordPress Plugins and 1 WordPress Theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 85 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 139
Unpatched 7

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Low Severity 1
Medium Severity 90
High Severity 48
Critical Severity 7

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Missing Authorization 36
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 31
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 26
Exposure of Sensitive Information to an Unauthorized Actor 10
Authorization Bypass Through User-Controlled Key 7
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 7
Incorrect Privilege Assignment 5
Cross-Site Request Forgery (CSRF) 3
Deserialization of Untrusted Data 3
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 3
Improper Control of Generation of Code (‘Code Injection’) 3
Server-Side Request Forgery (SSRF) 3
Unrestricted Upload of File with Dangerous Type 3
Improper Privilege Management 2
Embedded Malicious Code 1
External Control of File Name or Path 1
Incorrect Authorization 1
Weak Password Recovery Mechanism for Forgotten Password 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

14

8

7

7

6

4

4

4

3

3

3

3

3

3

2

2

2

2

2

2

2

2

2

2

2

2

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1
5b840087cae0a13b411eb404ad102a47
Yat

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
2Download Connector for 2DL Hosted Checkout 2download-connector
Abandoned Cart Pro for WooCommerce woocommerce-abandon-cart-pro
Abandoned Contact Form 7 abandoned-contact-form-7
Advanced Ads – Ad Manager & AdSense advanced-ads
Advanced Import advanced-import
Advanced Order Export For WooCommerce woo-order-export-lite
Appointment Booking Calendar appointment-booking-calendar
Attendance Manager attendance-manager
Avada (Fusion) Builder fusion-builder
BetterDocs Pro betterdocs-pro
BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot betterdocs
Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation bit-integrations
Blocksy Companion blocksy-companion
Bogo bogo
Branda – White Label & Branding, Free Login Page Customizer branda-white-labeling
Bricksable for Bricks Builder bricksable
Cargo Shipping Location for WooCommerce cargo-shipping-location-for-woocommerce
CF7 to Webhook cf7-to-zapier
CheckView – Form & Checkout Testing checkview
Classified Listing – AI-Powered Classified ads & Business Directory classified-listing
Clean Login clean-login
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe contest-gallery
Cornerstone cornerstone
Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress counter-box
Creavi Appointment Booking Calendar creavi-booking-service
Database for Contact Form 7, WPforms, Elementor forms contact-form-entries
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy dokan-lite
E2Pdf – Export Pdf Tool for WordPress e2pdf
Enable CORS enable-cors
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More envira-gallery-lite
Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance accessibility-checker
Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets eventkoi-lite
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) wp-event-solution
Falang multilanguage for WordPress falang
Fancy Testimonials fancy-testimonials
FireBox Popups – Increase Sales and Grow Your Email List firebox
Five Star Restaurant Menu and Food Ordering food-and-drink-menu
Five Star Restaurant Reservations – WordPress Booking Plugin restaurant-reservations
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder form-maker
GEO my WP geo-my-wp
GEO Plugin by Squirrly SEO squirrly-seo
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory geodirectory
GetGenie – AI Content Writer with Keyword Research & SEO Tracking getgenie
GIFT4U – Gift Cards All in One for Woo gift4u-gift-cards-all-in-one-for-woo
Gutenverse Companion gutenverse-companion
Interactive Content – H5P h5p
Intranet & Private Site – All-In-One Intranet all-in-one-intranet
JetBooking jet-booking
JetEngine jet-engine
JetFormBuilder — Dynamic Blocks Form Builder jetformbuilder
JobSearch WP Job Board wp-jobsearch
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor kadence-blocks
King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder king-addons
LatePoint – Calendar Booking Plugin for Appointments and Events latepoint
License Manager for WooCommerce license-manager-for-woocommerce
Listdom: AI-powered Business Directory with Classifieds Ads Listings listdom
MapPress Maps for WordPress mappress-google-maps-for-wordpress
Master Slider – Responsive Touch Slider master-slider
MDTF – Meta Data and Taxonomies Filter wp-meta-data-filter-and-taxonomy-filter
Media Library Assistant media-library-assistant
Melhor Envio melhor-envio-cotacao
Motors – Car Dealership & Classified Listings Plugin motors-car-dealership-classified-listings
MStore API – Create Native Android & iOS Apps On The Cloud mstore-api
Newsletters newsletters-lite
Nexi XPay cartasi-x-pay
Object Cache 4 everyone object-cache-4-everyone
Ocean Product Sharing ocean-product-sharing
Offload, AI & Optimize with Cloudflare Images cf-images
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization optimole-wp
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More themeisle-companion
Paymob for WooCommerce paymob-for-woocommerce
PDF Builder for WooCommerce. Create invoices,packing slips and more woo-pdf-invoice-builder
Permalink Manager Lite permalink-manager
Pods – Custom Content Types and Fields pods
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred mycred
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups ays-popup-box
PowerPress Podcasting plugin by Blubrry powerpress
Premmerce Dev Tools premmerce-dev-tools
Premmerce Wishlist for WooCommerce premmerce-woocommerce-wishlist
PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin pressprimer-quiz
Quads Ads Manager for Google AdSense quick-adsense-reloaded
Registration Form for WooCommerce registration-form-for-woocommerce
Royal Addons for Elementor – Addons and Templates Kit for Elementor royal-elementor-addons
Royal MCP – Secure AI Connector for Claude, ChatGPT & Gemini royal-mcp
RTMKit rometheme-for-elementor
SALESmanago & Leadoo salesmanago
Secure Client Portal and Private File Sharing Plugin – User Private Files user-private-files
Services Section Block – Showcase Service Details in Grid or Columns services-section
Sigma Forms Pro sigmaforms-pro
Simple File List simple-file-list
Simple Membership simple-membership
Slideshow Gallery LITE slideshow-gallery
SlimStat Analytics wp-slimstat
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery sms-alert
Static Block static-block
STRABL – A checkout solution strabl-a-checkout-solution
Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator stylish-cost-calculator
SupportCandy – Helpdesk & Customer Support Ticket System supportcandy
SureDash – Community, Courses & Member Dashboard suredash
Syncee Premium Dropshipping & Wholesale syncee-global-dropshipping
SysBasics Customize My Account for WooCommerce – Live My Account Customizer customize-my-account-for-woocommerce
Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups trinity-backup
Tutor LMS – eLearning and online course solution tutor
UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce
User Admin Simplifier user-admin-simplifier
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP userswp
Video Conferencing with Zoom video-conferencing-with-zoom-api
Visual Link Preview visual-link-preview
Vitepos – Point of Sale (POS) for WooCommerce vitepos-lite
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce woosquare
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors wc-vendors
WCPOS – Point of Sale (POS) plugin for WooCommerce woocommerce-pos
Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets widget-options
WooCommerce Stripe Payment Gateway woocommerce-gateway-stripe
Woosa – Marktplaats for WooCommerce integration-marktplaats-for-woocommerce
Workscout Core workscout-core
WP Activity Log wp-security-audit-log
WP DSGVO Tools (GDPR) shapepress-dsgvo
WP Easy Pay – Payment and Donation form Builder for Square wp-easy-pay
Wp EMember wp-eMember
WP Go Maps – Google Map, OpenStreetMap, Leaflet Map wp-google-maps
WP Hotel Booking wp-hotel-booking
WP Photo Album Plus wp-photo-album-plus
WP Review Slider Pro wp-review-slider-pro
WP Travel Gutenberg Blocks wp-travel-blocks
wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin wpdatatables
YMC Filter ymc-smart-filter

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Real Estate 7 WordPress realestate-7

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

BetterDocs Pro <= 3.8.0 – Unauthenticated Local File Inclusion via doc_style

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-7515
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

BetterDocs Pro [betterdocs-pro]

Researcher

More Details >

Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 – Unauthenticated Privilege Escalation via Account Takeover

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-11551
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

Branda – White Label & Branding, Free Login Page Customizer [branda-white-labeling]

Researchers

More Details >

Enable CORS <= 2.0.3 – Backdoor

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-54833
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Enable CORS [enable-cors]

Researcher

More Details >

Registration Form for WooCommerce <= 1.0.9 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-54807
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Registration Form for WooCommerce [registration-form-for-woocommerce]

Researcher

More Details >

Sigma Forms Pro <= 1.4.5 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-52705
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

Sigma Forms Pro [sigmaforms-pro]

Researcher

More Details >

Avada (Fusion) Builder <= 3.15.3 – Unauthenticated Arbitrary File Deletion via Form Entry Value

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-8713
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Avada (Fusion) Builder [fusion-builder]

Researcher

More Details >

Workscout Core <= 1.7.11 – Unauthenticated Arbitrary File Deletion

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-52716
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

Workscout Core [workscout-core]

Researcher

More Details >

Abandoned Cart Pro for WooCommerce <= 10.4.0 – Authenticated (Subscriber+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-56010
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

Abandoned Cart Pro for WooCommerce [woocommerce-abandon-cart-pro]

Researcher

More Details >

Avada (Fusion) Builder <= 3.15.4 – Authenticated (Contributor+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-56008
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Avada (Fusion) Builder [fusion-builder]

Researcher

More Details >

Contest Gallery <= 30.0.2 – Authenticated (Author+) Privilege Escalation via ‘RegistryUserRole’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-12165
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]

Researchers

More Details >

E2Pdf <= 1.32.26 – Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via ‘screen_action’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-12407
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

E2Pdf – Export Pdf Tool for WordPress [e2pdf]

Researcher

More Details >

Falang multilanguage for WordPress <= 1.4.2 – Authenticated (Subscriber+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-54805
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Falang multilanguage for WordPress [falang]

Researcher

More Details >

JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.1 – Authenticated (Subscriber+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-54196
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]

Researcher

More Details >

Offload, AI & Optimize with Cloudflare Images <= 1.10.2 – Authenticated (Author+) Remote Code Execution via ‘api-key’ / ‘account-id’ Parameters in cf_images_do_setup AJAX Action

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-9860
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Offload, AI & Optimize with Cloudflare Images [cf-images]

Researcher

5b840087cae0a13b411eb404ad102a47Yat

More Details >

PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.8 – Authenticated (Subscriber+) Remote Code Execution

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-52704
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

PDF Builder for WooCommerce. Create invoices,packing slips and more [woo-pdf-invoice-builder]

Researcher

More Details >

Premmerce Dev Tools <= 2.0 – Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via Plugin Creation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-6933
Patch Status
Unpatched
Published
Jun 15, 2026

Affected Software

Premmerce Dev Tools [premmerce-dev-tools]

Researcher

More Details >

Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets <= 4.2.3 – Authenticated (Contributor+) Remote Code Execution

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-54823
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets [widget-options]

Researcher

More Details >

WP Review Slider Pro <= 12.6.8 – Authenticated (Subscriber+) SQL Injection via ‘curselrevs’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-8444
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

WP Review Slider Pro [wp-review-slider-pro]

Researcher

More Details >

WP Review Slider Pro <= 12.6.8 – Authenticated (Subscriber+) SQL Injection via ‘stypes’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-8443
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

WP Review Slider Pro [wp-review-slider-pro]

Researcher

More Details >

Advanced Ads – Ad Manager & AdSense <= 2.0.21 – Authenticated (Contributor+) Remote Code Execution

8.3

CVSS Rating
8.3 (High)
CVE-ID

CVE-2026-54816
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Advanced Ads – Ad Manager & AdSense [advanced-ads]

Researcher

More Details >

Avada (Fusion) Builder <= 3.15.4 – Authenticated (Contributor+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-54193
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Avada (Fusion) Builder [fusion-builder]

Researcher

More Details >

Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 – Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-9843
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

Database for Contact Form 7, WPforms, Elementor forms [contact-form-entries]

Researcher

More Details >

MDTF – Meta Data and Taxonomies Filter <= 1.3.8 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-54845
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

MDTF – Meta Data and Taxonomies Filter [wp-meta-data-filter-and-taxonomy-filter]

Researcher

More Details >

WP Activity Log <= 5.6.3.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-54806
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

WP Activity Log [wp-security-audit-log]

Researcher

More Details >

WP Review Slider Pro <= 12.6.8 – Authenticated (Subscriber+) Arbitrary File Deletion via ‘myaction’ Parameter

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-8442
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

WP Review Slider Pro [wp-review-slider-pro]

Researcher

More Details >

Avada (Fusion) Builder <= 3.15.4 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54194
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

Avada (Fusion) Builder [fusion-builder]

Researcher

More Details >

Cargo Shipping Location for WooCommerce <= 5.6 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54815
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Cargo Shipping Location for WooCommerce [cargo-shipping-location-for-woocommerce]

Researcher

More Details >

GEO my WP <= 4.5.5 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-52715
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

GEO my WP [geo-my-wp]

Researcher

More Details >

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.162 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54831
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]

Researcher

More Details >

GIFT4U – Gift Cards All in One for Woo <= 1.0.10 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54809
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

GIFT4U – Gift Cards All in One for Woo [gift4u-gift-cards-all-in-one-for-woo]

Researcher

More Details >

JetBooking <= 4.0.4.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54820
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

JetBooking [jet-booking]

Researcher

More Details >

JetEngine <= 3.8.10.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54187
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

JetEngine <= 3.8.10.1 – Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-12360
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

JobSearch WP Job Board <= 3.2.9 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54186
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

JobSearch WP Job Board [wp-jobsearch]

Researcher

More Details >

LatePoint <= 5.5.1 – Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-8176
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

LatePoint – Calendar Booking Plugin for Appointments and Events [latepoint]

Researcher

More Details >

Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.4.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54819
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Listdom: AI-powered Business Directory with Classifieds Ads Listings [listdom]

Researcher

More Details >

MDTF – Meta Data and Taxonomies Filter <= 1.3.7 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54843
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

MDTF – Meta Data and Taxonomies Filter [wp-meta-data-filter-and-taxonomy-filter]

Researcher

More Details >

Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 – Authenticated (Subscriber+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54814
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researcher

More Details >

Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54812
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researcher

More Details >

Premmerce Wishlist for WooCommerce <= 1.1.11 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54849
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Premmerce Wishlist for WooCommerce [premmerce-woocommerce-wishlist]

Researcher

More Details >

Real Estate 7 WordPress <= 3.5.9 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54827
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Real Estate 7 WordPress [realestate-7]

Researcher

More Details >

Simple File List <= 6.3.7 – Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-11912
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

Simple File List [simple-file-list]

Researchers

More Details >

Simple File List <= 6.3.7 – Unauthenticated Arbitrary File Deletion via Path Traversal in ‘eeSubFolder’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-11911
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

Simple File List [simple-file-list]

Researchers

More Details >

Wp EMember < v10.9.4 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54811
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Wp EMember [wp-eMember]

Researcher

More Details >

WP Photo Album Plus <= 9.1.13.005 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54829
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

WP Photo Album Plus [wp-photo-album-plus]

Researcher

More Details >

WP Travel Gutenberg Blocks <= 3.9.4 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54808
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

WP Travel Gutenberg Blocks [wp-travel-blocks]

Researcher

More Details >

wpDataTables (Premium) <= 7.4 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54825
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables]

Researcher

More Details >

YMC Filter <= 3.11.5 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-54836
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

YMC Filter [ymc-smart-filter]

Researcher

More Details >

CF7 to Webhook <= 5.0.0 – Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Host

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-11395
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

CF7 to Webhook [cf7-to-zapier]

Researcher

More Details >

JetEngine <= 3.8.10 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-54189
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

JetEngine <= 3.8.10 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-54188
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.0.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-54195
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]

Researcher

More Details >

MapPress Maps for WordPress <= 2.97.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-56011
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

MapPress Maps for WordPress [mappress-google-maps-for-wordpress]

Researcher

More Details >

Master Slider – Responsive Touch Slider <= 3.11.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-56014
Patch Status
Unpatched
Published
Jun 19, 2026

Affected Software

Master Slider – Responsive Touch Slider [master-slider]

Researcher

More Details >

Pods – Custom Content Types and Fields <= 3.3.8 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-54191
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

Pods – Custom Content Types and Fields [pods]

Researcher

More Details >

Counter Box <= 2.0.13 – Authenticated (Administrator+) PHP Object Injection via Import

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-12115
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress [counter-box]

Researcher

More Details >

Attendance Manager <= 0.6.2 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-52712
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

Attendance Manager [attendance-manager]

Researcher

More Details >

Bit integrations <= 2.8.7 – Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-11989
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation [bit-integrations]

Researcher

More Details >

Cornerstone < 7.8.8 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-54185
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Cornerstone [cornerstone]

Researcher

More Details >

Media Library Assistant <= 3.35 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-56012
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Media Library Assistant [media-library-assistant]

Researcher

More Details >

Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 – 1.7.1059 – Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-8118
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]

Researcher

More Details >

RTMKit <= 2.0.7 – Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via ‘entries_id’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-5149
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

RTMKit [rometheme-for-elementor]

Researcher

More Details >

SALESmanago & Leadoo <= 3.11.2 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-54822
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

SALESmanago & Leadoo [salesmanago]

Researcher

More Details >

Simple File List <= 6.3.7 – Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via ‘frontmanage’ Shortcode Attribute

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-12119
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

Simple File List [simple-file-list]

Researchers

More Details >

SlimStat Analytics <= 5.4.11 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-54818
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

SlimStat Analytics [wp-slimstat]

Researcher

More Details >

SureDash – Community, Courses & Member Dashboard <= 1.8.0 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-54813
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

SureDash – Community, Courses & Member Dashboard [suredash]

Researcher

More Details >

WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.6.8 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-54838
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors [wc-vendors]

Researcher

More Details >

WooCommerce Stripe Payment Gateway <= 10.7.0 – Missing Authorization to Unauthenticated Order Status Manipulation via ‘order’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-2381
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

WooCommerce Stripe Payment Gateway [woocommerce-gateway-stripe]

Researcher

More Details >

Advanced Import: One-Click Demo Import for WordPress <= 1.4.6 – Authenticated (Author+) Server-Side Request Forgery via ‘demo_file’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-4328
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Advanced Import [advanced-import]

Researcher

More Details >

Appointment Booking Calendar <= 1.4.4 – Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-1856
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Creavi Appointment Booking Calendar [creavi-booking-service]

Researchers

More Details >

BetterDocs <= 4.5.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘blockId’ Block Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-12157
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot [betterdocs]

Researcher

More Details >

Bricksable for Bricks Builder <= 1.6.83 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-56009
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Bricksable for Bricks Builder [bricksable]

Researcher

More Details >

Fancy Testimonials <= 1.0 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8039
Patch Status
Unpatched
Published
Jun 17, 2026

Affected Software

Fancy Testimonials [fancy-testimonials]

Researcher

More Details >

File Sharing & Download Manager <= 2.1.6 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘fldr_ttl’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-10093
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

Secure Client Portal and Private File Sharing Plugin – User Private Files [user-private-files]

Researcher

More Details >

King Addons for Elementor <= 51.1.62 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘form_page_id’ Parameter

6.4

CVSS Rating
6.4 (Medium)
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder [king-addons]

Researcher

More Details >

myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘wrap’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8607
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred [mycred]

Researcher

More Details >

Permalink Manager Lite <= 2.5.3.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8494
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Permalink Manager Lite [permalink-manager]

Researcher

More Details >

PowerPress Podcasting plugin by Blubrry <= 11.16.8 – Authenticated (Author+) Stored Cross-Site Scripting via ’embed’ Episode Meta Field

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-12098
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

PowerPress Podcasting plugin by Blubrry [powerpress]

Researcher

More Details >

Services Section Block <= 1.4.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘link’ Block Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-11402
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Services Section Block – Showcase Service Details in Grid or Columns [services-section]

Researcher

More Details >

Slideshow Gallery LITE <= 1.8.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘alwaysauto’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-2021
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Slideshow Gallery LITE [slideshow-gallery]

Researcher

More Details >

SysBasics Customize My Account for WooCommerce <= 4.3.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-12136
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

SysBasics Customize My Account for WooCommerce – Live My Account Customizer [customize-my-account-for-woocommerce]

Researchers

More Details >

WP Activity Log <= 5.6.3.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-56005
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

WP Activity Log [wp-security-audit-log]

Researcher

More Details >

Interactive Content – H5P <= 1.17.6 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-56006
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Interactive Content – H5P [h5p]

Researcher

More Details >

Media Library Assistant <= 3.35 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-54198
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

Media Library Assistant [media-library-assistant]

Researcher

More Details >

Popup Box – Create Countdown, Coupon, Video, Contact Form Popups <= 6.2.9 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-54192
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Popup Box – Create Countdown, Coupon, Video, Contact Form Popups [ays-popup-box]

Researcher

More Details >

SysBasics Customize My Account for WooCommerce <= 4.3.6 – Reflected Cross-Site Scripting via ‘tab’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-12137
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

SysBasics Customize My Account for WooCommerce – Live My Account Customizer [customize-my-account-for-woocommerce]

Researchers

More Details >

2Download Connector for 2DL Hosted Checkout <= 0.1.5 – Missing Authorization to Unauthenticated Sensitive Customer Subscription Data Exposure via ‘ToDownload_email’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-6798
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

2Download Connector for 2DL Hosted Checkout [2download-connector]

Researcher

More Details >

Abandoned Contact Form 7 <= 2.2 – Missing Authorization to Unauthenticated Arbitrary Post Deletion via ‘recover_id’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9187
Patch Status
Unpatched
Published
Jun 15, 2026

Affected Software

Abandoned Contact Form 7 [abandoned-contact-form-7]

Researcher

More Details >

CheckView – Form & Checkout Testing <= 2.1.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54844
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

CheckView – Form & Checkout Testing [checkview]

Researcher

More Details >

Clean Login <= 1.15 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54184
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Clean Login [clean-login]

Researcher

More Details >

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More <= 1.12.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54190
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]

Researcher

More Details >

Event Koi Lite <= 1.3.13.1 – Missing Authorization to Unauthenticated Sensitive Information Exposure via REST API Endpoints

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-10029
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets [eventkoi-lite]

Researcher

More Details >

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.12 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2025-68045
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution]

Researcher

More Details >

FireBox Popups <= 3.1.7 – Unauthenticated Sensitive Information Exposure in ‘form_id’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12120
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

FireBox Popups – Increase Sales and Grow Your Email List [firebox]

Researcher

More Details >

Five Star Restaurant Menu and Food Ordering <= 2.5.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54835
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Five Star Restaurant Menu and Food Ordering [food-and-drink-menu]

Researcher

More Details >

Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.19 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54830
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Five Star Restaurant Reservations – WordPress Booking Plugin [restaurant-reservations]

Researcher

More Details >

GEO Plugin by Squirrly SEO <= 12.4.16 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-52714
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

GEO Plugin by Squirrly SEO [squirrly-seo]

Researcher

More Details >

GetGenie – AI Content Writer with Keyword Research & SEO Tracking <= 4.4.1 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54197
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

GetGenie – AI Content Writer with Keyword Research & SEO Tracking [getgenie]

Researcher

More Details >

Gutenverse Companion <= 2.5.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54832
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Gutenverse Companion [gutenverse-companion]

Researcher

More Details >

Intranet & Private Site – All-In-One Intranet <= 1.8.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54837
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Intranet & Private Site – All-In-One Intranet [all-in-one-intranet]

Researcher

More Details >

License Manager for WooCommerce <= 3.0.15 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56013
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

License Manager for WooCommerce [license-manager-for-woocommerce]

Researcher

More Details >

Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54828
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researcher

More Details >

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.18.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54817
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

MStore API – Create Native Android & iOS Apps On The Cloud [mstore-api]

Researcher

More Details >

Newsletters <= 4.13 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54840
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Newsletters [newsletters-lite]

Researcher

More Details >

Nexi XPay <= 8.3.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54810
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Nexi XPay [cartasi-x-pay]

Researcher

More Details >

Object Cache 4 everyone <= 2.3.2 – Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54834
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Object Cache 4 everyone [object-cache-4-everyone]

Researcher

More Details >

Paymob for WooCommerce <= 4.1.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-56025
Patch Status
Unpatched
Published
Jun 19, 2026

Affected Software

Paymob for WooCommerce [paymob-for-woocommerce]

Researcher

More Details >

Quads Ads Manager for Google AdSense <= 3.0.3 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54824
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Quads Ads Manager for Google AdSense [quick-adsense-reloaded]

Researcher

More Details >

Simple Membership <= 4.7.5 – Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe ‘charge.refunded’ Webhook

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12093
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Simple Membership [simple-membership]

Researcher

More Details >

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54802
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery [sms-alert]

Researcher

More Details >

STRABL <= 4.5 – Unauthenticated Arbitrary Webhook Creation via REST API Endpoint

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-3640
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

STRABL – A checkout solution [strabl-a-checkout-solution]

Researcher

More Details >

Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator <= 8.3.9 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54847
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator [stylish-cost-calculator]

Researcher

More Details >

Syncee Premium Dropshipping & Wholesale <= 1.0.27 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54846
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Syncee Premium Dropshipping & Wholesale [syncee-global-dropshipping]

Researcher

More Details >

Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54839
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups [trinity-backup]

Researcher

More Details >

Video Conferencing with Zoom <= 4.6.7 – Missing Authorization to Unauthenticated Zoom SDK Credential Exposure via ‘get_auth’ AJAX Action

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-6964
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

Video Conferencing with Zoom [video-conferencing-with-zoom-api]

Researcher

More Details >

Vitepos – Point of Sale (POS) for WooCommerce <= 3.4.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54841
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Vitepos – Point of Sale (POS) for WooCommerce [vitepos-lite]

Researcher

More Details >

WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce <= 4.7.3 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-54848
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce [woosquare]

Researcher

More Details >

WCPOS – Point of Sale (POS) plugin for WooCommerce <= 1.8.14 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-52711
Patch Status
Patched
Published
Jun 15, 2026

Affected Software

WCPOS – Point of Sale (POS) plugin for WooCommerce [woocommerce-pos]

Researcher

More Details >

WP DSGVO Tools (GDPR) <= 3.1.39 – Missing Authorization to Unauthenticated Sensitive Personal Data Disclosure via subject-access-request AJAX Endpoint (process_now/is_ajax Parameters)

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-10034
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

WP DSGVO Tools (GDPR) [shapepress-dsgvo]

Researcher

More Details >

WP Go Maps <= 10.1.01 – Unauthenticated Arbitrary Record Creation

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12238
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

WP Go Maps – Google Map, OpenStreetMap, Leaflet Map [wp-google-maps]

Researcher

More Details >

Advanced Order Export For WooCommerce <= 4.0.10 – Authenticated (Shop Manager+) SQL Injection via ‘sort_direction’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-11360
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Advanced Order Export For WooCommerce [woo-order-export-lite]

Researcher

More Details >

Form Maker by 10Web <= 1.15.43 – Authenticated (Administrator+) SQL Injection via ‘name’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-11777
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder [form-maker]

Researcher

More Details >

Form Maker by 10Web <= 1.15.43 – Authenticated (Adminsitrator+) SQL Injection via ‘groupids’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-11776
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder [form-maker]

Researcher

More Details >

Tutor LMS <= 3.9.11 – Authenticated (Administrator+) SQL Injection via ‘data’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-10736
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

More Details >

Woosa <= 2.0.5 – Authenticated (Administrator+) Arbitrary File Read via ‘log_file’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-7547
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Woosa – Marktplaats for WooCommerce [integration-marktplaats-for-woocommerce]

Researcher

More Details >

Blocksy Companion <= 2.1.45 – Authenticated (Editor+) Stored Cross-Site Scripting via ‘product_description’ Parameter

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-12430
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Blocksy Companion [blocksy-companion]

Researcher

More Details >

Ocean Product Sharing <= 2.2.2 – Authenticated (Shop manager+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-56007
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Ocean Product Sharing [ocean-product-sharing]

Researcher

More Details >

Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.6 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘menu-item-icon’ Parameter

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-11358
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More [themeisle-companion]

Researcher

More Details >

Appointment Booking Calendar <= 1.4.01 – Authenticated (Contributor+) Sensitive Information Exposure via ‘id’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12111
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Appointment Booking Calendar [appointment-booking-calendar]

Researchers

More Details >

Bogo <= 3.9.1 – Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via REST API

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9013
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Bogo [bogo]

Researcher

More Details >

Classified Listing <= 5.4.2 – Missing Authorization to Authenticated (Subscriber+) Feature Modification via Multiple AJAX Handlers (‘listingId’/’id’ Parameters)

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-10779
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]

Researcher

More Details >

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.3 – Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-10023
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite]

Researcher

More Details >

Equalize Digital Accessibility Checker <= 1.42.1 – Missing Authorization to Authenticated (Author+) Arbitrary Accessibility Issue Modification via ‘largeBatch’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9199
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance [accessibility-checker]

Researcher

More Details >

Kadence Blocks <= 3.7.5 – Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11357
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]

Researcher

More Details >

Melhor Envio <= 2.16.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-54804
Patch Status
Patched
Published
Jun 16, 2026

Affected Software

Melhor Envio [melhor-envio-cotacao]

Researcher

More Details >

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6 – Cross-Site Request Forgery via ‘optml_replace_file’ AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11784
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization [optimole-wp]

Researcher

More Details >

PressPrimer Quiz <= 2.3.0 – Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Modification via ‘quiz_id’, ‘item_id’, and ‘rule_id’ Parameters

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-10623
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin [pressprimer-quiz]

Researcher

More Details >

Royal MCP – Secure AI Connector for Claude, ChatGPT & Gemini <= 1.4.25 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-54842
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

Royal MCP – Secure AI Connector for Claude, ChatGPT & Gemini [royal-mcp]

Researcher

More Details >

Static Block <= 2.2 – Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode ‘id’ Attribute

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-10780
Patch Status
Unpatched
Published
Jun 15, 2026

Affected Software

Static Block [static-block]

Researcher

More Details >

SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.6 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-54826
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

SupportCandy – Helpdesk & Customer Support Ticket System [supportcandy]

Researcher

More Details >

UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-56023
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

UPI QR Code Payment Gateway for WooCommerce [upi-qr-code-payment-for-woocommerce]

Researcher

More Details >

User Admin Simplifier <= 3.0.0 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11775
Patch Status
Patched
Published
Jun 18, 2026

Affected Software

User Admin Simplifier [user-admin-simplifier]

Researcher

More Details >

Visual Link Preview <= 2.3.1 – Authenticated (Subscriber+) Sensitive Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-54821
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

Visual Link Preview [visual-link-preview]

Researcher

More Details >

WP Easy Pay – Payment and Donation form Builder for Square <= 4.5.0 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-56024
Patch Status
Unpatched
Published
Jun 18, 2026

Affected Software

WP Easy Pay – Payment and Donation form Builder for Square [wp-easy-pay]

Researcher

More Details >

WP Hotel Booking < 2.3.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9822
Patch Status
Patched
Published
Jun 19, 2026

Affected Software

WP Hotel Booking [wp-hotel-booking]

Researcher

More Details >

UsersWP <= 1.2.63 – Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via ‘user_id’ Parameter

2.7

CVSS Rating
2.7 (Low)
CVE-ID

CVE-2026-12102
Patch Status
Patched
Published
Jun 17, 2026

Affected Software

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP [userswp]

Researcher

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (June 15, 2026 to June 21, 2026) appeared first on Wordfence.

]]> Critical Unauthenticated Arbitrary File Deletion Vulnerability Patched in Avada Builder WordPress Plugin https://swiftupdates.ca/critical-unauthenticated-arbitrary-file-deletion-vulnerability-patched-in-avada-builder-wordpress-plugin/ Thu, 18 Jun 2026 18:38:41 +0000 https://swiftupdates.ca/critical-unauthenticated-arbitrary-file-deletion-vulnerability-patched-in-avada-builder-wordpress-plugin/ On May 13th, 2026, we received a submission for a critical Unauthenticated Arbitrary File Deletion vulnerability in Avada Builder, a premium WordPress plugin with an estimated 1,000,000 active installations. This vulnerability makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file, such as wp-config.php, is deleted. Exploitation requires a published Avada form configured to save entries to the database.

Props to daroo who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $3,600.00 for this discovery. Our mission is to secure WordPress through defense in depth, which is why we are investing in quality vulnerability research and collaborating with researchers of this caliber through our Bug Bounty Program. We are committed to making the WordPress ecosystem more secure through the detection and prevention of vulnerabilities, which is a critical element to the multi-layered approach to security.

All Wordfence users, including those running Wordfence Premium, Wordfence Care, and Wordfence Response, as well as sites running the free version of Wordfence, are protected against any exploits targeting this vulnerability by the Wordfence firewall’s built-in path traversal protection.

We provided full disclosure details to the Avada team through our Wordfence Vulnerability Management Portal on May 15, 2026. The developer acknowledged the report and submitted a patch on May 19, 2026. We would like to commend the Avada team for their prompt response and timely patch.

We urge users to update their sites to the latest patched version of Avada Builder as soon as possible.

Vulnerability Summary from Wordfence Intelligence

Avada (Fusion) Builder <= 3.15.3 – Unauthenticated Arbitrary File Deletion via Form Entry Value

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-8713
Affected Version(s)
<= 3.15.3
Patched Version
3.15.4
Bounty
$3,600.00

Affected Software

Avada (Fusion) Builder [fusion-builder]

Researcher

The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and including, 3.15.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The attack requires a published Avada form configured to save entries to the database; an unauthenticated attacker submits a path-traversal payload via the wp_ajax_nopriv_fusion_form_submit_ajax handler while also controlling the fusion_privacy_expiration_interval and privacy_expiration_action fields to force an immediate ‘delete’ cleanup, causing the planted entry to be automatically processed by the Fusion_Form_DB_Privacy shutdown-hook routine without any administrator interaction.

More Details >

Technical Analysis

Avada Builder is a premium drag-and-drop page builder plugin for WordPress, bundled with the popular Avada theme. It includes a form builder feature that allows site administrators to create custom forms, embed them on pages via a shortcode, and optionally save submitted entries to the database. The form builder also supports a privacy cleanup feature that can automatically delete or anonymize stored submissions after a configurable expiration period.

When the cleanup routine runs, or when the administrator manually deletes the form entry, the plugin invokes the maybe_delete_files() function from the Fusion_Form_DB_Entries class for the stored entry, which is where the actual file deletion takes place:

public function maybe_delete_files( $id, $id_column = 'id' ) {
	$args                           = [];
	$args[ esc_attr( $id_column ) ] = $id;
	$entries                        = $this->get( [ 'where' => $args ] );

	if ( is_array( $entries ) && ! empty( $entries ) ) {
		$upload         = wp_upload_dir();
		$upload['path'] = $upload['basedir'] . '/fusion-forms';
		$upload['url']  = $upload['baseurl'] . '/fusion-forms';

		foreach ( $entries as $entry ) {

			// Check if it holds a file URL.
			if ( $entry && isset( $entry->value ) && false !== strpos( $entry->value, $upload['url'] ) ) {
				$values = explode( ' | ', $entry->value );

				foreach ( $values as $value ) {
					$file_path = str_replace( $upload['url'], $upload['path'], $value );

					// File exists, delete it.
					if ( file_exists( $file_path ) ) {
						wp_delete_file( $file_path );
					}
				}
			}
		}
	}
}

The function searches each stored entry value for the Avada Forms upload URL. If found, it builds a filesystem path by string-replacing the URL prefix with the local upload directory path and deletes the resulting target with the wp_delete_file() function. Unfortunately, the function does not perform any realpath resolution or upload-directory containment check, meaning that path traversal sequences are preserved in the final file path.

By submitting a form with a text field value such as http://victim.com/wp-content/uploads/fusion-forms/․․/․․/․․/wp-config.php, an unauthenticated attacker can plant an entry that causes wp-config.php to be deleted when the entry is removed.

Once wp-config.php is deleted, the WordPress installation enters its initial setup state, which can be leveraged for site takeover by pointing the installation at an attacker-controlled database. From there, the attacker can install plugins or themes containing malicious PHP code, ultimately achieving remote code execution.

As with all arbitrary file deletion vulnerabilities, this can lead to complete site compromise.

Wordfence Firewall

The following graphic demonstrates the steps to exploitation an attacker might take and at which point the Wordfence firewall would block an attacker from successfully exploiting the vulnerability.

fusion builder file delete howto wordfence firewall

The Wordfence firewall rule detects the path traversal sequence in the submitted form data and blocks the request.

Disclosure Timeline

May 13, 2026 – We received the submission for the Unauthenticated Arbitrary File Deletion vulnerability in Avada Builder via the Wordfence Bug Bounty Program.
May 15, 2026 – We validated the report and confirmed the proof-of-concept exploit. Full disclosure details were sent instantly to the vendor through our Wordfence Vulnerability Management Portal.
May 19, 2026 – The vendor acknowledged the report and submitted a patch.
June 2, 2026 – The fully patched version of the plugin, 3.15.4, was released.

Conclusion

In this blog post, we detailed a critical Unauthenticated Arbitrary File Deletion vulnerability within the Avada Builder plugin affecting all versions up to, and including, 3.15.3. This vulnerability allows unauthenticated threat actors to delete arbitrary files on the server by abusing the form builder’s privacy cleanup feature, leading to complete site compromise when critical files such as wp-config.php are deleted. The vulnerability has been fully addressed in version 3.15.4 of the plugin.

We encourage WordPress users to verify that their sites are updated to the latest patched version of Avada Builder as soon as possible considering the critical nature of this vulnerability.

All Wordfence users, including those running Wordfence Premium, Wordfence Care, and Wordfence Response, as well as sites running the free version of Wordfence, are fully protected against this vulnerability by the Wordfence firewall’s built-in path traversal protection.

If you know someone who uses this plugin on their site, we recommend sharing this advisory with them to ensure their site remains secure, as this vulnerability poses a significant risk.

The post Critical Unauthenticated Arbitrary File Deletion Vulnerability Patched in Avada Builder WordPress Plugin appeared first on Wordfence.

]]> Wordfence Intelligence Weekly WordPress Vulnerability Report (June 8, 2026 to June 14, 2026) https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-june-8-2026-to-june-14-2026/ Thu, 18 Jun 2026 18:38:41 +0000 https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-june-8-2026-to-june-14-2026/ Last week, there were 102 vulnerabilities disclosed in 90 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 68 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 78
Unpatched 24

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 62
High Severity 36
Critical Severity 4

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 35
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 13
Exposure of Sensitive Information to an Unauthorized Actor 12
Cross-Site Request Forgery (CSRF) 8
Missing Authorization 8
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 5
Deserialization of Untrusted Data 4
Authorization Bypass Through User-Controlled Key 3
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 3
Incorrect Privilege Assignment 3
Improper Privilege Management 2
Server-Side Request Forgery (SSRF) 2
Access of Resource Using Incompatible Type (‘Type Confusion’) 1
Improper Verification of Cryptographic Signature 1
Incorrect Authorization 1
Unrestricted Upload of File with Dangerous Type 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

6

5

4

3

3

3

3

3

2

2

2

2

2

2

2

2

2

2

2

2

2

2

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
6Storage Rentals 6storage-rentals
ABC Crypto Checkout payerurl-crypto-currency-payment-gateway-for-woocommerce
Accordions accordions
Advanced 301 and 302 Redirect advanced-301-and-302-redirect
Affiliates Manager affiliates-manager
Ajax Load More – Infinite Scroll, Load More, & Lazy Load ajax-load-more
AJAX Report Comments report-comments
Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates animation-addons-for-elementor
aThemes Addons for Elementor athemes-addons-for-elementor-lite
Booking (Reservation & Appointment) directorist-booking
BookPro – Appointment Booking WordPress Plugin ovabookpro
Canvas canvas
CleanTalk Anti-Spam. Spam Firewall & Bot protection cleantalk-spam-protect
Conekta Payment Gateway conekta-payment-gateway
Coupon Affiliates – Affiliate Plugin for WooCommerce woo-coupon-usage
Custom Block Builder – Lazy Blocks lazy-blocks
Customer Support Ticket System & Helpdesk wp-ticket
Decent Comments decent-comments
Digital Signature Add-on for WooCommerce woocommerce-digital-signature
Doctreat Core doctreat_core
Easy Image Collage easy-image-collage
eCommerce Product Catalog Plugin for WordPress ecommerce-product-catalog
Email Encoder – Protect Email Addresses and Phone Numbers email-encoder-bundle
Enable Media Replace enable-media-replace
Events Calendar for GeoDirectory events-for-geodirectory
Extra Settings for RocketChat extra-settings-for-rocketchat
FastDup – Fastest WordPress Migration & Duplicator fastdup
FastPicker, an order picker and order management system (oms) for WooCommerce on steroids fastpicker
Faust.js faustwp
Fediverse Embeds fediverse-embeds
Feeds for YouTube (YouTube video, channel, and gallery plugin) feeds-for-youtube
Fortis for WooCommerce fortis-for-woocommerce
FV Flowplayer Video Player fv-wordpress-flowplayer
Global Body Mass Index Calculator global-body-mass-index-calculator
GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites gptranslate
Hash Elements hash-elements
Helpfulcrowd Product Reviews helpfulcrowd-product-reviews
Hippoo Mobile App for WooCommerce hippoo
JetBlog jet-blog
JetEngine jet-engine
jQuery Hover Footnotes jquery-hover-footnotes
kk blog card kk-blog-card
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more knit-pay
Listdom: AI-powered Business Directory with Classifieds Ads Listings listdom
LoginPress Pro loginpress-pro
LWS Optimize – All-in-One Speed Booster & Cache Tools lws-optimize
MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails mailerpress
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates learning-management-system
Meow Gallery meow-gallery
MW WP Form mw-wp-form
Newsletters newsletters-lite
Online Scheduling and Appointment Booking System – Bookly bookly-responsive-appointment-booking-tool
Open User Map PRO open-user-map-pro
Page Builder: Pagelayer – Drag and Drop website builder pagelayer
Payment forms, Buy now buttons, and Invoicing System | GetPaid invoicing
Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel foogallery
Plugin Name: ePaperFlip Publisher epaperflip-publisher
Presto Player presto-player
Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages unlimited-elementor-inner-sections-by-boomdevs
Product Filter Widget for Elementor product-filter-widget-for-elementor
PushEngage – Web Push Notifications, WooCommerce Automation & Chat Widget pushengage
Recover Exit For WooCommerce recoverexit-for-woocommerce
RomanCart Ecommerce romancart-ecommerce
Schema & Structured Data for WP & AMP schema-and-structured-data-for-wp
SEO Redirection Plugin – 301 Redirect Manager seo-redirection
Slider Revolution revslider
Store Locator WordPress agile-store-locator
Taskbuilder – Project Management & Task Management Tool With Kanban Board taskbuilder
The Events Calendar the-events-calendar
TinyMCE shortcode Addon 360crest-themeone-tinymce-shortcodes
UpdraftPlus Premium updraftplus
UpdraftPlus: WP Backup & Migration Plugin updraftplus
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration wp-user-frontend
VikRentCar Car Rental Management System vikrentcar
WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce wc-multishipping
WooCommerce Anti-Fraud woocommerce-anti-fraud
WooCommerce Dropshipping Premium woocommerce-dropshipping
WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. wp_scraper
WP ApplicantStack Jobs Display wp-applicantstack-jobs-display
WP Emoticon Rating wp-emoticon-rating
WP GDPR Cookie Consent wp-gdpr-cookie-consent
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters wp-google-map-plugin
WP Meta Sort Posts wp-meta-sort-posts
WP Migrate Lite – Migration Made Easy wp-migrate-db
WP Photo Album Plus wp-photo-album-plus
WP-Ultimate-Map wp-ultimate-map
WPC Product Options for WooCommerce wpc-product-options
wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin wpdatatables
WpMobi wp-mobi
WPZOOM Portfolio Lite – Filterable Portfolio Plugin wpzoom-portfolio

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Blocksy blocksy
EventPress eventpress
Kastell – WordPress Theme for Single Properties and Apartments kastell
nifty nifty
XStore xstore

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Doctreat Core <= 1.6.8 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2025-6254
Patch Status
Patched
Published
Jun 9, 2026

Affected Software

Doctreat Core [doctreat_core]

Researcher

More Details >

Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.5.0 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-49063
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Listdom: AI-powered Business Directory with Classifieds Ads Listings [listdom]

Researcher

More Details >

LoginPress Pro <= 6.2.2 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-49058
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

LoginPress Pro [loginpress-pro]

Researcher

More Details >

WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2025-69129
Patch Status
Unpatched
Published
Jun 12, 2026

Affected Software

WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. [wp_scraper]

Researcher

More Details >

Blocksy <= 2.1.41 – Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via ‘blocksy_meta’ REST API Field

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-8365
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Blocksy [blocksy]

Researcher

More Details >

Events Calendar for GeoDirectory <= 2.3.28 – Authenticated (Subscriber+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-11616
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Events Calendar for GeoDirectory [events-for-geodirectory]

Researcher

More Details >

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.2.0 – Authenticated (Subscriber+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-49111
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]

Researcher

More Details >

JetEngine <= 3.8.10 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-52706
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

Kastell <= 2.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-52707
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Kastell – WordPress Theme for Single Properties and Apartments [kastell]

Researcher

More Details >

Nifty <= 1.4.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-27429
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

nifty [nifty]

Researcher

More Details >

Recover Exit For WooCommerce <= 1.0.3 – Unauthenticated Local File Inclusion via ‘tpf’ Parameter

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-9662
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

Recover Exit For WooCommerce [recoverexit-for-woocommerce]

Researcher

More Details >

UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 (free) < 2.26.5 (premium) – Unauthenticated Authentication Bypass via UpdraftCentral udrpc

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-10795
Patch Status
Patched
Published
Jun 10, 2026

Affected Software

UpdraftPlus: WP Backup & Migration Plugin [updraftplus]
UpdraftPlus Premium [updraftplus]

Researcher

More Details >

6Storage Rentals <= 2.22.0 – Unauthenticated Insecure Direct Object Reference to Arbitrary User Disclosure and Modification via ‘userId’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-9185
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

6Storage Rentals [6storage-rentals]

Researcher

More Details >

Advanced 301 and 302 Redirect <= 1.6.9 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-49067
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Advanced 301 and 302 Redirect [advanced-301-and-302-redirect]

Researcher

More Details >

BookPro <= 1.1.0 – Unauthenticated Arbitrary File Deletion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-27400
Patch Status
Unpatched
Published
Jun 12, 2026

Affected Software

BookPro – Appointment Booking WordPress Plugin [ovabookpro]

Researcher

More Details >

Decent Comments < 3.0.2 – Unauthenticated Information Exopsure

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-7385
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

Decent Comments [decent-comments]

Researcher

More Details >

eCommerce Product Catalog Plugin for WordPress <= 3.5.5 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-52693
Patch Status
Patched
Published
Jun 9, 2026

Affected Software

eCommerce Product Catalog Plugin for WordPress [ecommerce-product-catalog]

Researcher

More Details >

JetEngine < 3.8.9.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-49084
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

JetEngine <= 3.8.9.1 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-49075
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

JetEngine <= 3.8.9.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-49076
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

Newsletters <= 4.13 – Unauthenticated SQL Injection via wpmlsubscriber_id Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-3018
Patch Status
Patched
Published
Jun 9, 2026

Affected Software

Newsletters [newsletters-lite]

Researcher

More Details >

The Events Calendar 6.15.12-6.16.2 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-49772
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

The Events Calendar [the-events-calendar]

Researcher

More Details >

WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 – Unauthenticated Arbitrary File Download

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2025-69131
Patch Status
Unpatched
Published
Jun 12, 2026

Affected Software

WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. [wp_scraper]

Researcher

More Details >

WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.3 – Authenticated (Subscriber+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-6381
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters [wp-google-map-plugin]

Researcher

More Details >

WP Photo Album Plus < 9.1.11.001 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-6379
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

WP Photo Album Plus [wp-photo-album-plus]

Researcher

More Details >

WP Ticket <= 6.0.4 – Unauthenticated SQL Injection via WordPress Search ‘s’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-9848
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Customer Support Ticket System & Helpdesk [wp-ticket]

Researcher

More Details >

WPC Product Options for WooCommerce <= 3.2.1 – Unauthenticated Arbitrary File Download

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-49061
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

WPC Product Options for WooCommerce [wpc-product-options]

Researcher

More Details >

wpDataTables (Premium) <= 7.3.6 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-49080
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables]

Researcher

More Details >

XStore < 9.7.3 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-3326
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

XStore [xstore]

Researcher

More Details >

Ajax Load More – Infinite Scroll, Load More, & Lazy Load < 7.8.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-6495
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

Ajax Load More – Infinite Scroll, Load More, & Lazy Load [ajax-load-more]

Researcher

More Details >

CleanTalk Anti-Spam. Spam Firewall & Bot protection < 6.79 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-8071
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

CleanTalk Anti-Spam. Spam Firewall & Bot protection [cleantalk-spam-protect]

Researcher

More Details >

Email Encoder – Protect Email Addresses and Phone Numbers < 2.4.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-5776
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

Email Encoder – Protect Email Addresses and Phone Numbers [email-encoder-bundle]

Researcher

More Details >

Fediverse Embeds <= 1.5.7 – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-46697
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Fediverse Embeds [fediverse-embeds]

Researcher

More Details >

Fediverse Embeds <= 1.5.7 – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-46698
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Fediverse Embeds [fediverse-embeds]

Researcher

More Details >

FV Flowplayer Video Player <= 7.5.49.7212 – Unauthenticated Stored Cross-Site Scripting via Comment Text

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-7556
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

FV Flowplayer Video Player [fv-wordpress-flowplayer]

Researchers

More Details >

GPTranslate <= 2.31 – Unauthenticated Stored Cross-Site Scripting via REST API Translation Storage

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-9109
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites [gptranslate]

Researchers

More Details >

JetEngine <= 3.8.9.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-49074
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

JetEngine [jet-engine]

Researcher

More Details >

Online Scheduling and Appointment Booking System – Bookly <= 27.2 – Unauthenticated Stored Cross-Site Scripting via ‘bookly-customer-full-name’ Cookie

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-5513
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

More Details >

SEO Redirection Plugin – 301 Redirect Manager <= 9.17 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-52702
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

SEO Redirection Plugin – 301 Redirect Manager [seo-redirection]

Researcher

More Details >

WPZOOM Portfolio Lite – Filterable Portfolio Plugin <= 1.4.21 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-49069
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

WPZOOM Portfolio Lite – Filterable Portfolio Plugin [wpzoom-portfolio]

Researcher

More Details >

Booking (Reservation & Appointment) <= 3.0.3 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-49073
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Booking (Reservation & Appointment) [directorist-booking]

Researcher

More Details >

Slider Revolution 7.0 – 7.0.10 – Authenticated (Subscriber+) Sensitive Information Disclosure

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-7542
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Slider Revolution [revslider]

Researcher

More Details >

Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.7 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-52697
Patch Status
Patched
Published
Jun 10, 2026

Affected Software

Taskbuilder – Project Management & Task Management Tool With Kanban Board [taskbuilder]

Researcher

More Details >

WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce <= 3.0.2 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-52700
Patch Status
Patched
Published
Jun 10, 2026

Affected Software

WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce [wc-multishipping]

Researcher

More Details >

Accordions <= 2.3.23 – Authenticated (Custom+) Stored Cross-Site Scripting via Accordion Body Field

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-10862
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Accordions [accordions]

Researcher

More Details >

Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates <= 2.6.7 – Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2025-8444
Patch Status
Unpatched
Published
Jun 9, 2026

Affected Software

Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates [animation-addons-for-elementor]

Researcher

More Details >

aThemes Addons for Elementor <= 1.1.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘title_tag’ Widget Setting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8613
Patch Status
Patched
Published
Jun 9, 2026

Affected Software

aThemes Addons for Elementor [athemes-addons-for-elementor-lite]

Researcher

More Details >

Canvas <= 2.5.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘tag’ Block Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-9629
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Canvas [canvas]

Researcher

More Details >

Easy Image Collage <= 1.13.6 – Authenticated (Author+) Stored Cross-Site Scripting via ‘grid[properties][borderColor]’ and ‘grid[images][N][attachment_url]’ Parameters

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-9019
Patch Status
Patched
Published
Jun 9, 2026

Affected Software

Easy Image Collage [easy-image-collage]

Researcher

More Details >

Enable Media Replace <= 4.1.8 – Authenticated (Author+) Stored Cross-Site Scripting via ‘location_dir’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-5714
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Enable Media Replace [enable-media-replace]

Researcher

More Details >

ePaperFlip Publisher <= 1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘publicationid’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-7662
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

Plugin Name: ePaperFlip Publisher [epaperflip-publisher]

Researcher

More Details >

Extra Settings for RocketChat <= 0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8841
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

Extra Settings for RocketChat [extra-settings-for-rocketchat]

Researcher

More Details >

Global Body Mass Index Calculator <= 1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8883
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

Global Body Mass Index Calculator [global-body-mass-index-calculator]

Researcher

More Details >

jQuery Hover Footnotes <= 1.4 – Authenticated (Author+) Stored Cross-Site Scripting via Footnote Qualifier (‘{{…}}’ Syntax)

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-10738
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

jQuery Hover Footnotes [jquery-hover-footnotes]

Researcher

More Details >

kk blog card <= 1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8895
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

kk blog card [kk-blog-card]

Researcher

More Details >

MailerPress <= 2.0.4 – Authenticated (Author+) Stored Cross-Site Scripting via Campaign HTML Content Field

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8599
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails [mailerpress]

Researcher

More Details >

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 – Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-3297
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Page Builder: Pagelayer – Drag and Drop website builder [pagelayer]

Researchers

More Details >

Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel <= 3.1.31 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘custom_attribute_key’ Shortcode Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-9134
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel [foogallery]

Researcher

More Details >

Prime Elementor Addons <= 1.3.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Widget HTML Tag Settings

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8677
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages [unlimited-elementor-inner-sections-by-boomdevs]

Researcher

More Details >

RomanCart Ecommerce <= 2.0.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8880
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

RomanCart Ecommerce [romancart-ecommerce]

Researcher

More Details >

The Ultimate Video Player For WordPress <= 4.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘link_url’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-9125
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

Presto Player [presto-player]

Researcher

More Details >

TinyMCE shortcode Addon <= 1.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘btnrel’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-10024
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

TinyMCE shortcode Addon [360crest-themeone-tinymce-shortcodes]

Researcher

More Details >

WP ApplicantStack Jobs Display <= 1.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8882
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

WP ApplicantStack Jobs Display [wp-applicantstack-jobs-display]

Researcher

More Details >

WP GDPR Cookie Consent <= 1.0.0 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘ninja_gdpr_ajax_actions’ AJAX Action

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8977
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

WP GDPR Cookie Consent [wp-gdpr-cookie-consent]

Researchers

More Details >

EventPress < 22.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-6268
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

EventPress [eventpress]

Researcher(s): Unknown

More Details >

Product Filter Widget for Elementor <= 1.0.6 – Reflected Cross-Site Scripting via ‘args[filterFormArray]’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-11603
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

Product Filter Widget for Elementor [product-filter-widget-for-elementor]

Researcher

More Details >

WP Emoticon Rating <= 1.0.1 – Cross-Site Request Forgery to Reflected Cross-Site Scripting via ’emo_settings’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-8910
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

WP Emoticon Rating [wp-emoticon-rating]

Researcher

More Details >

WP-Ultimate-Map <= 1.1 – Cross-Site Request Forgery to Stored Cross-Site Scripting via ‘zoom-level’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-8907
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

WP-Ultimate-Map [wp-ultimate-map]

Researcher

More Details >

ABC Crypto Checkout <= 1.8.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-52695
Patch Status
Patched
Published
Jun 10, 2026

Affected Software

ABC Crypto Checkout [payerurl-crypto-currency-payment-gateway-for-woocommerce]

Researcher

More Details >

Affiliates Manager <= 2.9.50 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-52692
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Affiliates Manager [affiliates-manager]

Researcher

More Details >

Conekta Payment Gateway <= 6.0.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49066
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Conekta Payment Gateway [conekta-payment-gateway]

Researcher

More Details >

Digital Signature Add-on for WooCommerce <= 2.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-52694
Patch Status
Patched
Published
Jun 10, 2026

Affected Software

Digital Signature Add-on for WooCommerce [woocommerce-digital-signature]

Researcher

More Details >

FastDup – Fastest WordPress Migration & Duplicator <= 2.7.2 – Unauthenticated Path Traversal

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-52703
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

FastDup – Fastest WordPress Migration & Duplicator [fastdup]

Researcher

More Details >

Fortis for WooCommerce < 1.3.1 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2025-15609
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

Fortis for WooCommerce [fortis-for-woocommerce]

Researcher(s): Unknown

More Details >

Helpfulcrowd Product Reviews <= 1.2.9 – Inccorect Authorization via Type Juggling in ‘token’ Parameter to Arbitrary Settings Update

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-8499
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

Helpfulcrowd Product Reviews [helpfulcrowd-product-reviews]

Researcher

More Details >

Hippoo Mobile App for WooCommerce <= 1.9.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49065
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Hippoo Mobile App for WooCommerce [hippoo]

Researcher

More Details >

JetBlog <= 2.4.8 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-52696
Patch Status
Patched
Published
Jun 10, 2026

Affected Software

JetBlog [jet-blog]

Researcher

More Details >

Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more <= 9.4.0.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49070
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more [knit-pay]

Researcher

More Details >

Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.49 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49064
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Payment forms, Buy now buttons, and Invoicing System | GetPaid [invoicing]

Researcher

More Details >

Schema & Structured Data for WP & AMP < 1.60 – Unauthenticated Arbitrary Media Upload

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9067
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp]

Researcher

More Details >

VikRentCar Car Rental Management System <= 1.4.5 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-52699
Patch Status
Patched
Published
Jun 10, 2026

Affected Software

VikRentCar Car Rental Management System [vikrentcar]

Researcher

More Details >

WooCommerce Anti-Fraud <= 7.2.6 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49072
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

WooCommerce Anti-Fraud [woocommerce-anti-fraud]

Researcher

More Details >

WooCommerce Dropshipping Premium <= 5.2.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49071
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

WooCommerce Dropshipping Premium [woocommerce-dropshipping]

Researcher

More Details >

WS Optimize – All-in-One Speed Booster & Cache Tools <= 3.3.19 – Authenticated (Editor+) Arbitrary File Read

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-12089
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

LWS Optimize – All-in-One Speed Booster & Cache Tools [lws-optimize]

Researcher

More Details >

Open User Map PRO <= 1.4.31 – Unauthenticated Stored Cross-Site Scripting via ‘oum_location_notification’

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-2827
Patch Status
Patched
Published
Jun 10, 2026

Affected Software

Open User Map PRO [open-user-map-pro]

Researcher

More Details >

Custom Block Builder – Lazy Blocks < 4.3.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-8981
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

Custom Block Builder – Lazy Blocks [lazy-blocks]

Researcher

More Details >

MW WP Form <= 5.1.3 – Authenticated (Editor+) Stored Cross-Site Scripting via ‘memo’ Parameter

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-8853
Patch Status
Patched
Published
Jun 9, 2026

Affected Software

MW WP Form [mw-wp-form]

Researcher

More Details >

Store Locator WordPress < 1.6.6 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-9060
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

Store Locator WordPress [agile-store-locator]

Researcher

More Details >

AJAX Report Comments <= 2.0.4 – Cross-Site Request Forgery to Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8902
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

AJAX Report Comments [report-comments]

Researcher

More Details >

Coupon Affiliates – Affiliate Plugin for WooCommerce <= 7.8.1 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-49068
Patch Status
Patched
Published
Jun 9, 2026

Affected Software

Coupon Affiliates – Affiliate Plugin for WooCommerce [woo-coupon-usage]

Researcher

More Details >

FastPicker, an order picker and order management system (oms) for WooCommerce on steroids <= 1.0.2 – Cross-Site Request Forgery via Settings Save

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8904
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

FastPicker, an order picker and order management system (oms) for WooCommerce on steroids [fastpicker]

Researcher

More Details >

Faust.js <= 1.8.7 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-49062
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

Faust.js [faustwp]

Researcher

More Details >

Feeds for YouTube (YouTube video, channel, and gallery plugin) < 2.6.4 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-1631
Patch Status
Patched
Published
Jun 11, 2026

Affected Software

Feeds for YouTube (YouTube video, channel, and gallery plugin) [feeds-for-youtube]

Researcher

More Details >

Hash Elements <= 1.5.4 – Authenticated (Contributor+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-24618
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Hash Elements [hash-elements]

Researcher

More Details >

jQuery Hover Footnotes <= 1.4 – Cross-Site Request Forgery to Plugin Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-10553
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

jQuery Hover Footnotes [jquery-hover-footnotes]

Researcher

More Details >

Meow Gallery <= 5.4.4 – Missing Authorization to Authenticated (Author+) Shortcode creation

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-1291
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Meow Gallery [meow-gallery]

Researcher

More Details >

Pagelayer <= 2.0.9 – Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via ‘contacts’

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-2470
Patch Status
Patched
Published
Jun 12, 2026

Affected Software

Page Builder: Pagelayer – Drag and Drop website builder [pagelayer]

Researcher

More Details >

PushEngage – Web Push Notifications, WooCommerce Automation & Chat Widget <= 4.2.3 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-52698
Patch Status
Patched
Published
Jun 10, 2026

Affected Software

PushEngage – Web Push Notifications, WooCommerce Automation & Chat Widget [pushengage]

Researcher

More Details >

User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.2 – Missing Authorization to Authenticated (Subscriber+) Subscription Pack Cancellation

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-4058
Patch Status
Patched
Published
Jun 8, 2026

Affected Software

User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration [wp-user-frontend]

Researcher

More Details >

WP Meta Sort Posts <= 0.9 – Cross-Site Request Forgery to Plugin Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8940
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

WP Meta Sort Posts [wp-meta-sort-posts]

Researcher

More Details >

WP Migrate Lite – Migration Made Easy <= 2.7.8 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-49043
Patch Status
Patched
Published
Jun 10, 2026

Affected Software

WP Migrate Lite – Migration Made Easy [wp-migrate-db]

Researcher

More Details >

WpMobi <= 0.0.3 – Cross-Site Request Forgery via save_general_settings Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8909
Patch Status
Unpatched
Published
Jun 8, 2026

Affected Software

WpMobi [wp-mobi]

Researcher

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (June 8, 2026 to June 14, 2026) appeared first on Wordfence.

]]> Attackers Actively Exploiting Sensitive Information Exposure Vulnerability in Gravity SMTP Plugin https://swiftupdates.ca/attackers-actively-exploiting-sensitive-information-exposure-vulnerability-in-gravity-smtp-plugin/ Wed, 17 Jun 2026 17:39:42 +0000 https://swiftupdates.ca/attackers-actively-exploiting-sensitive-information-exposure-vulnerability-in-gravity-smtp-plugin/ On March 30th, 2026, we publicly disclosed a Sensitive Information Exposure vulnerability in Gravity SMTP, a WordPress plugin with an estimated 100,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to retrieve detailed system configuration data and, critically, any API keys, secrets, and OAuth tokens configured for the plugin’s email integrations. The vendor released the fully patched version on March 17th, 2026, and we originally disclosed this vulnerability in the Wordfence Intelligence vulnerability database on March 30th, 2026. The Wordfence Firewall has already blocked over 17 million exploit attempts targeting this vulnerability.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against any exploits targeting this vulnerability on May 5, 2026. Sites using the free version of Wordfence received the same protection 30 days later on June 4, 2026. Unlike most vulnerabilities, the firewall rule protecting against this issue was not added as part of our standard vulnerability disclosure process, because the initial assessment of the vulnerability severity was under the threshold to create a firewall rule to protect against attacks. However, we continuously monitor for attacks and new threats, so when we received reports of active exploitation, we implemented a rule to protect against these attacks immediately.

Considering this vulnerability is being actively exploited, we urge users to ensure their sites are updated with the latest patched version of Gravity SMTP, version 2.1.5 at the time of this writing, as soon as possible.

Vulnerability Summary from Wordfence Intelligence

Gravity SMTP <= 2.1.4 – Unauthenticated Sensitive Information Exposure via REST API

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-4020
Affected Version(s)
<= 2.1.4
Patched Version
2.1.5
Bounty
$800.00

Affected Software

Gravity SMTP [gravitysmtp]

Researcher

The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is due to a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback that unconditionally returns true, allowing any unauthenticated visitor to access it. When the ?page=gravitysmtp-settings query parameter is appended, the plugin’s register_connector_data() method populates internal connector data, causing the endpoint to return approximately 365 KB of JSON containing the full System Report. This makes it possible for unauthenticated attackers to retrieve detailed system configuration data including PHP version, loaded extensions, web server version, document root path, database server type and version, WordPress version, all active plugins with versions, active theme, WordPress configuration details, database table names, and any API keys/tokens configured in the plugin.

More Details >

Vulnerability Details

Gravity SMTP relies on a shared library, also used across other Gravity Forms products, that provides a configuration collection system. This system gathers the data that the plugin needs to pass to its JavaScript code via wp_localize_script(), organized so that each piece of its configuration is only loaded on the page or script where it is actually needed.

As part of this library, the plugin registers a REST API endpoint at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback that unconditionally returns true. Because the permission callback never performs any authentication or capability check, the endpoint is accessible to any unauthenticated visitor:

register_rest_route( $this->rest_namespace, '/tests/mock-data', array(
	'methods'             => 'GET',
	'callback'            => array( $self, 'config_mocks_endpoint' ),
	'permission_callback' => function () {
		return true;
	},
) );

The endpoint’s callback, the config_mocks_endpoint() function in the Config_Collection_Service_Provider class, defines the GFORMS_DOING_MOCK constant and then collects and returns the config data:

public function config_mocks_endpoint() {
	define( 'GFORMS_DOING_MOCK', true );
	$data = $this->container->get( self::CONFIG_COLLECTION )->handle( false );

	return $data;
}

When the request includes the ?page=gravitysmtp-settings query parameter, the plugin populates the connector data used to build its settings screen, so that data is present among the configs at the time the mock dump runs. As a result, the endpoint returns a JSON object containing the plugin’s full System Report.

This System Report includes a wide range of sensitive information about the site, such as the PHP version and loaded extensions, the web server version and document root path, the database server type and version, the WordPress version and configuration details, the list of all active plugins and their versions, the active theme, and the database table names. Most critically, the report also includes the API keys, secrets, and OAuth tokens configured for the plugin’s email delivery integrations, including services such as Amazon SES, Google, Mailjet, Resend, and Zoho.

This makes it possible for unauthenticated attackers to harvest credentials that could be used to send email on behalf of the site, as well as to gather detailed reconnaissance about the site’s software stack that can be leveraged to identify and target other vulnerabilities.

As with all sensitive information exposure vulnerabilities, the impact depends on what data is exposed. In this case, the exposure of live third-party API credentials means an attacker could abuse the site’s connected email services, while the detailed system report significantly lowers the effort required to plan further attacks against the site.

A Closer Look at the Attack Data

The following data highlights actual exploit attempts from threat actors targeting this vulnerability. Exploitation is trivial, requiring only a single unauthenticated GET request to the vulnerable REST API endpoint.

Example attack request

GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1
Host: [redacted]
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

In the request above, the attacker sends an unauthenticated GET request to the /wp-json/gravitysmtp/v1/tests/mock-data REST API endpoint with the required ?page=gravitysmtp-settings query parameter. When the targeted site is running a vulnerable version of Gravity SMTP, the server responds with the full System Report JSON, including any configured email integration credentials, with no authentication required.

Wordfence Firewall

The following graphic demonstrates the steps to exploitation an attacker might take and at which point the Wordfence firewall would block an attacker from successfully exploiting the vulnerability.

gravitysmtp info exposure howto wordfence firewall

The Wordfence firewall rule detects the malicious REST API action and blocks the request if it does not come from an existing authorized administrator.

Total Number of Exploits Blocked

The Wordfence Firewall has blocked over 17 million exploit attempts targeting this vulnerability.

Blocked attacks WAF 911

According to our data, exploitation ramped up dramatically in early June, with the single largest spike occurring on June 7th, 2026, when over 4 million exploit attempts were blocked in a single day. We continued to detect and block a sustained, extremely high volume of exploit attempts from June 7th through June 11th, 2026, during which several million attempts were blocked each day.

Top Offending IP Addresses

The following IP Addresses are currently the most actively engaged IP addresses targeting the Gravity SMTP mock-data REST API endpoint:

  • 45.148.10.95
    • Over 642,000 blocked requests.
  • 193.32.162.60
    • Over 586,000 blocked requests.
  • 176.65.148.139
    • Over 539,000 blocked requests.
  • 173.199.90.188
    • Over 460,000 blocked requests.
  • 45.148.10.120
    • Over 410,000 blocked requests.
  • 185.8.107.155
    • Over 404,000 blocked requests.
  • 185.8.106.37
    • Over 399,000 blocked requests.
  • 185.8.106.92
    • Over 394,000 blocked requests.
  • 185.8.106.145
    • Over 387,000 blocked requests.
  • 176.65.148.30
    • Over 384,000 blocked requests.

Blocked attacks by IP WAF 911

Indicators of Compromise

Because this vulnerability exposes sensitive data via a simple GET request rather than modifying the site, exploitation may not leave obvious traces. It is recommended to review your web server access logs for any requests to the /wp-json/gravitysmtp/v1/tests/mock-data endpoint, particularly those including the ?page=gravitysmtp-settings query parameter.

If you are running a vulnerable version of Gravity SMTP and have configured any third-party email integrations (such as Amazon SES, Google, Mailjet, Resend, or Zoho), you should assume the associated API keys, secrets, and OAuth tokens may have been exposed. We strongly recommend rotating these credentials after updating the plugin.

We also recommend reviewing log files for any requests originating from the following IP addresses:

  • 45.148.10.95
  • 193.32.162.60
  • 176.65.148.139
  • 173.199.90.188
  • 45.148.10.120
  • 185.8.107.155
  • 185.8.106.37
  • 185.8.106.92
  • 185.8.106.145
  • 176.65.148.30

Conclusion

In today’s article, we covered the attack data for a Sensitive Information Exposure vulnerability in the Gravity SMTP plugin that allows unauthenticated threat actors to retrieve a detailed system report, including configured email integration credentials, via a single REST API request. Our threat intelligence indicates that attackers have been targeting this vulnerability at a massive scale, with the heaviest exploitation occurring between June 7th and June 11th, 2026. The Wordfence firewall has already blocked over 17 million exploit attempts targeting this vulnerability.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against any exploits targeting this vulnerability on May 5, 2026. Sites using the free version of Wordfence received the same protection 30 days later on June 4, 2026.

Even if you have already received a firewall rule for this issue we urge you to ensure that your site is updated to at least version 2.1.5 in order to maintain normal functionality, and to rotate any email integration credentials that may have been exposed. If you have friends or colleagues using Gravity SMTP, be sure to forward this advisory to them, as sites could still be unprotected and unpatched.

If you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care. If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both these products include hands-on support in case you need further assistance.

The post Attackers Actively Exploiting Sensitive Information Exposure Vulnerability in Gravity SMTP Plugin appeared first on Wordfence.

]]> PSA: Supply Chain Compromise Targets ShapedPlugin, Backdoored Pro Plugins Distributed via Official Channels https://swiftupdates.ca/psa-supply-chain-compromise-targets-shapedplugin-backdoored-pro-plugins-distributed-via-official-channels/ Tue, 16 Jun 2026 17:38:36 +0000 https://swiftupdates.ca/psa-supply-chain-compromise-targets-shapedplugin-backdoored-pro-plugins-distributed-via-official-channels/ The Wordfence Threat Intelligence Team was notified on June 11th, 2026 of a potential supply chain compromise affecting ShapedPlugin, a WordPress plugin vendor with over 400,000 active free plugin installations. Fortunately, Wordfence customers have already had malware signature detection for the particular backdoor used in this attack.

During our investigation, we discovered that attackers compromised the vendor’s build and distribution pipeline, injecting backdoor code into Pro plugin releases distributed through official licensed update channels. As with all supply chain compromises, this attack is particularly insidious because affected site owners followed security best practices: they purchased legitimate licenses and installed updates directly from the vendor’s official update system. Supply chain compromises are becoming significantly more common in all software, including WordPress software.

The ShapedPlugin’s team was notified by a Wordfence customer the same day their customer notified our team. In addition, our team reached out to the ShapedPlugin team on June 15th, 2026, after our team confirmed and analyzed the compromise. The ShapedPlugin’s team released a statement on June 16th, 2026:

“We confirm that we have received your notification and have taken this issue very seriously. Our team immediately initiated an investigation upon identifying the concern, and we have already implemented the necessary measures to mitigate the issue. Our security team is actively working to thoroughly analyze the reported indicators, review our distribution and release processes, and ensure the integrity of our products and infrastructure.

As part of our response, we are currently preparing updated plugin releases and conducting comprehensive security reviews and validation tests to ensure that all affected products are fully addressed before deployment. We expect to release new verified versions once these checks have been completed successfully.”

Two additional malware detection signatures were developed and released after undergoing our QA process between April 18th, 2026 and May 21st, 2026. All Wordfence Premium, Care, and Response customers received these signatures immediately, along with paid Wordfence CLI users. Users of the free version of Wordfence and Wordfence CLI received the same signatures after the standard 30-day delay.

Multiple ShapedPlugin Plugins < (Various Versions) – Backdoored Software

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-10735
Patch Status
Patched

Affected Software

Product Slider Pro for WooCommerce [woo-product-slider-pro]
Real Testimonials Pro [testimonial-pro]
Smart Post Show Pro [smart-show-post-pro]

Researcher

Multiple plugins by ShapedPlugin contain a backdoor in various versions. This makes it possible for unauthenticated attackers to achieve backdoor access to sites with the compromised copy of the software installed. CVE-2026-49777 is a duplicate of this CVE.

More Details >

As part of our product lineup, we offer security monitoring and malware removal services to our Wordfence Care and Response customers. In the event of a security incident, our incident response team will investigate the root cause, find and remove malware from your site, and help with other complications that may arise as a result of an infection. During the cleanup, malware samples are added to our Threat Intelligence database, which contains over 4.4 million unique malicious samples. The Wordfence plugin and Wordfence CLI scanner detect over 99% of these samples and indicators of compromise, when using the premium signatures set. Wordfence CLI can scan your site even if WordPress is no longer functional and is an excellent layer of security to implement at the server-level, part of our mission to secure the web by Defense in Depth.

 

Background: ShapedPlugin and Distribution Channels

ShapedPlugin, LLC maintains a portfolio of WordPress plugins spanning carousels, sliders, testimonials, accordions, and other UI components. Their free plugins are distributed through the WordPress.org plugin repository, while Pro versions are sold and distributed via Easy Digital Downloads (EDD) via account.shapedplugin.com.

The compromise only affects Pro plugin builds distributed through the vendor’s EDD infrastructure, not the free plugins on WordPress.org. The attacker had selective access to inject malware only into commercially licensed releases.

A related backdoor in ShapedPlugin’s Product Slider Pro for WooCommerce was assigned CVE-2026-49777 and reportedly patched in version 3.5.4. However, our investigation confirms that compromised packages continue to be distributed across other Pro products. We obtained a backdoored copy of Real Testimonials Pro 3.2.5 directly from the official vendor update endpoint on June 12nd, 2026.

 

Malware Analysis

Stage 1: The Loader

The compromised Real Testimonials Pro package contains a malicious file src/Includes/LicenseLoader.php and a modified src/Includes/TestimonialPRO.php that loads it on every admin page:

add_action(
    'admin_init',
    function () {
        $installer = SP_TPRO_PATH . 'Includes/LicenseLoader.php';
        if ( file_exists( $installer ) ) {
            require_once $installer;
        }
    }
);

Once triggered, LicenseLoader.php performs several actions:

  1. Downloads a payload from the C2 server at 194.76.217.28:2871
  2. Installs and activates it as a fake plugin using WordPress’s Plugin_Upgrader class
  3. Reports the victim domain back to the C2
  4. Removes itself and cleans the loader hook from TestimonialPRO.php to cover its tracks

This self-deleting behavior means the initial infection vector disappears after first execution, complicating forensic analysis for site owners who notice the infection later.

Stage 2: The Dropped Payload

The downloaded payload installs as wp-content/plugins/woocommerce-subscription/. Note the singular “subscription” versus the legitimate WooCommerce Subscriptions plugin which uses the plural form. We also observed a variation called woocommerce-notification, again in the singular form. This fake plugin bundles multiple attack tools:

File Function
woocommerce-subscription.php Main plugin file, hides plugin from admin list
install-persistent.php Persistence layer, REST API backdoor, data exfiltration
class-wc-admin-template.php Tiny File Manager 2.6
class-wc-template-builder.php Adminer 5.2.1
class-wc-subscription-diagnostics.php URL parameter webshell
class-wc-subscription-trace-dispatch.php Credential and 2FA secret stealer
class-wc-subscription-scheduler.php Backdoor login bypass

 

The fake plugin immediately hides itself from the WordPress admin plugin list via the all_plugins filter, making visual detection difficult, an important reminder of the value in malware scanners.

Credential Theft and 2FA Secret Exfiltration

The file class-wc-subscription-trace-dispatch.php hooks into WordPress authentication to capture credentials in plaintext. It intercepts both wp_authenticate and wp_login actions to collect:

  • Username and password
  • User IP address and User-Agent
  • Session cookies
  • User roles and capabilities

What makes this variant particularly concerning is its targeted exfiltration of two-factor authentication secrets. The malware specifically searches for TOTP seeds from multiple 2FA plugins:

// Targeted 2FA plugins and their storage locations:
// - WP 2FA: wp_2fa_totp_key (user meta)
// - Wordfence Login Security: wfls_2fa_secrets (custom table)
// - Really Simple SSL 2FA: rsssl_totp_secret (user meta)
// - Two-Factor plugin: _two_factor_totp_key (user meta)

Stolen credentials and 2FA secrets are exfiltrated to generate.2faplugin.org, a domain clearly chosen to blend in with legitimate 2FA-related traffic. With both passwords and TOTP seeds in hand, attackers can bypass multi-factor authentication entirely, even if victims change their passwords after discovering the compromise.

Multiple Backdoor Access Methods

The payload establishes several persistent access channels.

REST API Backdoor: The install-persistent.php file registers a custom REST endpoint at /wp-json/wc/v3/settings/apply that accepts arbitrary file writes when provided with the correct authentication token:

// POST /wp-json/wc/v3/settings/apply
// Parameters:
//   a = auth token (MD5 verified)
//   b = base64-encoded payload
//   f = target file path

URL Parameter Webshell: The diagnostics file accepts commands via URL parameters, supporting multiple execution methods:

// Parameters: k (auth token), d (base64 command), t (execution type)
// Types: s (shell_exec), e (exec), p (passthru), ph (eval)

Bundled Tools: Direct access to Tiny File Manager 2.6 and Adminer 5.2.1 provides attackers with convenient GUI-based file and database management.

Login Bypass: A hardcoded MD5 hash (e268c35a06d85f672e70c9beecb4e5d1) allows authentication bypass for any valid username: the attacker can log in as any administrator without knowing their password.

Data Exfiltration

When accessed directly, install-persistent.php displays a styled HTML page containing:

  • Full contents of wp-config.php (database credentials, auth keys, debug settings)
  • All administrator accounts with registration dates
  • Mail plugin credentials from WP Mail SMTP, Post SMTP, Easy WP SMTP, and others
  • WooCommerce order data from the last 3 months with payment method breakdown

After displaying this information, the file self-deletes.

Anti-Forensics

The malware employs several techniques to evade detection and complicate incident response:

  • Timestamp spoofing: Uses touch commands to match file modification times with nearby legitimate plugin files
  • Self-deletion: The loader removes itself after first execution
  • Plugin hiding: Filters itself out of the WordPress admin plugin list
  • Function obfuscation: Sensitive function names like shell_exec are constructed via chr() arrays:
// Obfuscated function name construction
$fn = array_map('chr', [115,104,101,108,108,95,101,120,101,99]);
$func = implode('', $fn); // "shell_exec"

Evidence of Pipeline Compromise

Several factors indicate this could be a CI/CD pipeline compromise rather than simple package tampering.

Surgical File Modification

Analysis of file timestamps within the compromised ZIP reveals a precise injection pattern:

Date File Count Significance
2025-04-22 366 Original legitimate build baseline
2026-02-25 100 Legitimate release update
2026-05-21 4 Backdoor injection
2026-05-23 3 Post-injection version bump

Only 4 files were modified on May 21st, 2026 within a 2-hour window, consistent with an automated build step that injects the backdoor, not manual tampering.

Git Build Artifacts

The Pro plugin ZIP contains composer metadata with a git SHA reference:

// vendor/composer/installed.php
'reference' => 'd0f349c04c2a3578a65b7e17bcabc84152a61b12',

This confirms the package was built from a private git repository, aligning with SVN commit messages that reference “Update from GitHub.”

SVN Committer Pattern Change

WordPress.org SVN logs reveal a notable shift in April 2026. Seven free plugins were batch-deployed to WordPress.org between April 8th and April 15th, 2026 under the shapedplugin committer account, all referencing “Update from GitHub”. The ShapedPlugin GitHub organization has no public repositories, indicating a private build pipeline.

Selective Injection

The attacker had access to deploy updates to both WordPress.org (free plugins) and the EDD system (Pro plugins), yet chose to only inject malware into some Pro builds. This selective approach suggests either:

  • Awareness that WordPress.org has malware scanning that might detect the payload
  • Targeting of paying customers who represent higher-value victims
  • An attempt to delay detection by keeping the more-visible free plugins clean

Scope of Compromise

Confirmed Compromised

  • Real Testimonials Pro 3.2.5 — confirmed on June 12th, 2026
  • Product Slider Pro (versions before 3.5.4) – CVE-2026-49777
  • Smart Post Pro (versions before 4.0.2) – CVE-2026-10735

Potentially Affected

We examined current versions of all other ShapedPlugin Pro plugins available as of June 15th, 2026. None contained the LicenseLoader.php backdoor or associated C2 indicators. We cannot determine whether earlier versions of these plugins were compromised and later replaced with clean builds. Bundle packages (WooCommerce Bundle, All Plugins Bundle, WordPress Bundle) may also be affected.
Given that Product Slider Pro was confirmed compromised before 3.5.4 and has since been patched, site owners who installed any ShapedPlugin Pro plugin between April and June 2026 should treat their sites as potentially compromised and follow the remediation steps below.

 

C2 Infrastructure

IP/Domain Purpose
194.76.217.28:2871 Payload delivery, victim beacon
generate.2faplugin.org Credential exfiltration

Both IP addresses are registered to AEZA GROUP LLC and appear to be related with Russian-based entities. The domain 2faplugin.org was updated on May 10th, 2026 shortly before the backdoor injection timestamps.

Timeline

Date Event
2025-05-03 Earliest payload file timestamp (Adminer 5.2.1)
2026-03-16 Tiny File Manager added to payload
2026-03-25 Last SVN commit by rubel_miah
2026-04-08/15 Batch SVN commits by shapedplugin across 7 free plugins
2026-05-09 Credential stealer and persistence layer finalized
2026-05-10 2faplugin.org domain updated
2026-05-18 First known victim infections (cache poisoning)
2026-05-21 LicenseLoader.php injected into Pro builds
2026-05-21 CVE-2026-49777 reported to Patchstack
2026-06-04 CVE-2026-49777 disclosed
2026-06-10 Wordfence customer observed infection following Real Testimonials Pro update
2026-06-12 Compromised package obtained from vendor endpoint

 

 

Indicators of Compromise

Type Value
Loader hash   0e17c869d3e4586d4c160041042bd15123c2a37117a98a995fae885f0f4417fc (LicenseLoader.php)
C2 IP   194.76.217.28:2871
Exfil domain   generate.2faplugin.org
REST endpoint   /wp-json/wc/v3/settings/apply
Fake plugin path   wp-content/plugins/woocommerce-subscription/
DB option   wp_options: theme_options_scripts
DB option   wp_options: wc_nf_install_done
Login bypass MD5   e268c35a06d85f672e70c9beecb4e5d1

 

Recommendations

If you have installed any ShapedPlugin Pro product:

  1. Scan immediately using Wordfence or Wordfence CLI with premium signatures
  2. Check for the fake plugin at
    1. wp-content/plugins/woocommerce-subscription/
    2. wp-content/plugins/woocommerce-notification/
    3. or similar suspicious variant
  3. Review wp_options for theme_options_scripts and wc_nf_install_done entries
  4. Rotate all credentials including WordPress admin passwords, database credentials, and any API keys in wp-config.php
  5. Revoke and regenerate 2FA secrets for all users: existing TOTP seeds may be compromised
  6. Review administrator accounts for unauthorized additions
  7. Check mail plugin configurations for modified SMTP credentials

Conclusion

This supply chain attack demonstrates the evolving threat landscape facing WordPress site owners. The attackers did not exploit a vulnerability in the plugin code itself: they compromised the vendor’s build and distribution infrastructure, turning legitimate licensed updates into malware delivery vehicles.

The inclusion of 2FA secret exfiltration marks a concerning evolution in WordPress-targeted malware. Attackers are no longer satisfied with stealing passwords alone; they are actively hunting the authentication factors that site owners deploy as additional security layers.

Site owners using ShapedPlugin Pro products should treat this as an active compromise and take immediate remediation steps. We will update this post as more information becomes available.

Wordfence Premium, Care and Response users, as well as paid Wordfence CLI customers, received malware signatures to detect this supply chain compromise between April 18th, 2026 and May 21st, 2026. Wordfence free users and Wordfence CLI free users received these signatures after a 30-day delay.

The post PSA: Supply Chain Compromise Targets ShapedPlugin, Backdoored Pro Plugins Distributed via Official Channels appeared first on Wordfence.

]]> Wordfence Intelligence Weekly WordPress Vulnerability Report (June 1, 2026 to June 7, 2026) https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-june-1-2026-to-june-7-2026/ Thu, 11 Jun 2026 18:41:15 +0000 https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-june-1-2026-to-june-7-2026/ Last week, there were 159 vulnerabilities disclosed in 140 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 96 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 134
Unpatched 25

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Low Severity 1
Medium Severity 96
High Severity 53
Critical Severity 9

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 43
Missing Authorization 28
Deserialization of Untrusted Data 17
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 16
Cross-Site Request Forgery (CSRF) 9
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 9
Exposure of Sensitive Information to an Unauthorized Actor 7
Authorization Bypass Through User-Controlled Key 6
Improper Control of Generation of Code (‘Code Injection’) 5
Incorrect Privilege Assignment 4
Improper Privilege Management 2
Insufficient Verification of Data Authenticity 2
Unrestricted Upload of File with Dangerous Type 2
Authentication Bypass Using an Alternate Path or Channel 1
Embedded Malicious Code 1
External Control of File Name or Path 1
Improper Authentication 1
Improper Authorization 1
Improper Input Validation 1
Improper Output Neutralization for Logs 1
Incorrect Authorization 1
Server-Side Request Forgery (SSRF) 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

8

8

6

4

4

4

4

4

3

3

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

1

1

1

1

1

1
5703ccf58e200369a20009dd05f3c424
Nvz

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1
5b840087cae0a13b411eb404ad102a47
Yat

1

1

1

1

1

1

1
5a50351dc3a5975487697a55ad3936d5
UKO

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
10WebAdManager ad-manager-wd
Active Products Tables for WooCommerce. Use constructor to create tables  profit-products-tables-for-woocommerce
Ad Inserter – Ad Manager & AdSense Ads ad-inserter
Admin Columns codepress-admin-columns
Advanced Google reCAPTCHA advanced-google-recaptcha
AI Chatbot & Workflow Automation by AIWU ai-copilot-content-generator
Alba Board alba-board
All-In-One Security (AIOS) – Security and Firewall all-in-one-wp-security-and-firewall
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup armember
Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) auto-image-attributes-from-filename-with-bulk-updater
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress automatorwp
Backup, Restore and Migrate your sites with XCloner xcloner-backup-and-restore
BirdSeed birdseed
Booking for Appointments and Events Calendar – Amelia ameliabooking
Booking Package booking-package
Booknetic booknetic
cformsII cforms2
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More charitable
Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons chatway-live-chat
Click to Chat – HoliThemes click-to-chat-for-whatsapp
Content Visibility for Divi Builder content-visibility-for-divi-builder
Cornerstone cornerstone
Debug Log Manager – Conveniently Monitor and Inspect Errors debug-log-manager
DeMomentSomTres Shortcodes demomentsomtres-shortcodes
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy dokan-lite
Drag and Drop Multiple File Upload for Contact Form 7 drag-and-drop-multiple-file-upload-contact-form-7
Easy Cart easy-cart
Easy Invoice – Invoice Generator, PDF Quotes & Payments easy-invoice
Elementor Website Builder – more than just a page builder elementor
ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system
Email Address Encoder email-address-encoder
email-encoder-premium email-encoder-premium
EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more embedpress
EmergencyWP – Dead Man’s switch & legacy deliverance emergencywp
Employee, Leave and Recruitment Management System – Crew HRM hr-management
Essential Addons for Elementor – Popular Elementor Templates & Widgets essential-addons-for-elementor-lite
Event Monster – Event Manager, Ticket Booking & Registration event-monster
Express Payment For Stripe wp-stripe-express
FPW Category Thumbnails fpw-category-thumbnails
Frontend User Notes frontend-user-notes
FunnelKit – Funnel Builder for WooCommerce Checkout funnel-builder
FV Flowplayer Video Player fv-wordpress-flowplayer
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress gamipress
Geo Mashup geo-mashup
Google Plus One Bottom google-plus-one-bottom
GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites gptranslate
Gravity Forms gravityforms
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns essential-blocks
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms happyforms
Hippoo Mobile App for WooCommerce hippoo
hiWeb Migration Simple hiweb-migration-simple
HollerBox — Fast & Effective Popups & Lead-Generation holler-box
Hybrid Composer hybrid-composer
Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms cf7-active-campaign
Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms cf7-constant-contact
Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More crm-integration-freshworks-any-form
Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms cf7-hubspot
Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms cf7-infusionsoft
Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms cf7-mailchimp
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms cf7-salesforce
JetSearch jet-search
JetSmartFilters jet-smart-filters
JobSearch WP Job Board wp-jobsearch
JS Help Desk – AI-Powered Support & Ticketing System js-support-ticket
JTL-Connector for WooCommerce woo-jtl-connector
King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder king-addons
Kirki – Freeform Page Builder, Website Builder & Customizer kirki
Klamra Paycal for Aspaclaria klamra-paycal-for-aspaclaria
Laiser Tag laiser-tag
LatePoint – Calendar Booking Plugin for Appointments and Events latepoint
LearnPress – Backup & Migration Tool learnpress-import-export
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses learnpress
MapPress Maps for WordPress mappress-google-maps-for-wordpress
Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits master-addons
MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro
MDJM Event Management mobile-dj-manager
Media folder Addon wp-media-folder-addon
Montonio for WooCommerce montonio-for-woocommerce
MW WP Form mw-wp-form
OptinCraft – Drag & Drop Optins & Popup Builder for WordPress optincraft
OttoKit: All-in-One Automation Platform suretriggers
Page-list page-list
Passeum Ticketing passeum-ticketing
Photo Gallery by 10Web – Mobile-Friendly Image Gallery photo-gallery
Product Filter Widget for Elementor product-filter-widget-for-elementor
Product Slider Pro for WooCommerce woo-product-slider-pro
Progress Planner progress-planner
Quick Playground quick-playground
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker quiz-master-next
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings seo-by-rank-math
RD Station integracao-rd-station
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) really-simple-ssl
Recipe Card Blocks Lite recipe-card-blocks-by-wpzoom
RegistrationMagic – User Registration Forms Plugin custom-registration-form-builder-with-submission-manager
Remove meta boxes per user role remove-meta-boxes-per-user-role
Remove NoFollow Commenter URL remove-nofollow-commenter-link
rognone rognone
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator feedzy-rss-feeds
SEO Plugin by Squirrly SEO squirrly-seo
Shared Files – Frontend File Upload Form & Secure File Sharing shared-files
Simple Custom Login Page simple-custom-login-page
Simple SEO Slideshow simple-seo-slideshow
Simple Shopping Cart wordpress-simple-paypal-shopping-cart
Slider Revolution revslider
SlimStat Analytics wp-slimstat
Smart Slider 3 smart-slider-3
SP Project & Document Manager sp-client-document-manager
Stop Spammers Classic stop-spammer-registrations-plugin
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions wp-full-stripe-free
Support Board supportboard
Tectite Forms tectite-forms
Thrive Apprentice thrive-apprentice
Tiled Gallery Carousel Without JetPack tiled-gallery-carousel-without-jetpack
Travelly – Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Solution tour-booking-manager
TrueBooker – Appointment Booking and Scheduler System truebooker-appointment-booking
Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. upsell-order-bump-offer-for-woocommerce
User Registration Stripe user-registration-stripe
VikBooking Hotel Booking Engine & PMS vikbooking
Visual Link Preview visual-link-preview
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels print-invoices-packing-slip-labels-for-woocommerce
Welcart e-Commerce usc-e-shop
Word Replacer word-replacer
Wp EMember wp-eMember
WP Go Maps – Google Maps, OpenStreetMap, Leaflet Map wp-google-maps
WP Google Review Slider wp-google-places-review-slider
WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms cf7-insightly
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website wp-job-portal
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters wp-google-map-plugin
WP Nano AD wp-nano-ad
WP Statistics – Simple, privacy-friendly Google Analytics alternative wp-statistics
WP Time Slots Booking Form wp-time-slots-booking-form
WP Travel Engine – Tour Booking Plugin – Tour Operator Software wp-travel-engine
WP User Manager – User Profile Builder & Membership wp-user-manager
WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms cf7-zendesk
WPC Product Bundles for WooCommerce woo-product-bundle
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More wpforms-lite
wpForo Forum wpforo
WPFunnels Pro wpfunnels-pro
WPvivid — Backup, Migration & Staging wpvivid-backuprestore
ZeM STL zem-stl-viewer

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
enfold enfold
Moderno – Fashion & Clothing, Furniture moderno

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

AI Chatbot & Workflow Automation by AIWU <= 1.4.17 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-48879
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

AI Chatbot & Workflow Automation by AIWU [ai-copilot-content-generator]

Researcher

More Details >

ARMember Premium <= 7.3.1 – Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-5076
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup [armember]

Researcher

More Details >

Easy Invoice – Invoice Generator, PDF Quotes & Payments <= 2.1.19 – Unauthenticated Remote Code Execution

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-48836
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

Easy Invoice – Invoice Generator, PDF Quotes & Payments [easy-invoice]

Researcher

More Details >

Hippoo Mobile App for WooCommerce <= 1.9.4 – Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-10580
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Hippoo Mobile App for WooCommerce [hippoo]

Researcher

More Details >

Kirki 6.0.0 – 6.0.6 – Unauthenticated Privilege Escalation via ‘handle_forgot_password’

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-8206
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

More Details >

Product Slider Pro for WooCommerce < 3.5.4 – Backdoored Software

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-49777
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

Product Slider Pro for WooCommerce [woo-product-slider-pro]

Researcher

More Details >

Support Board < 3.8.9 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-27395
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

Support Board [supportboard]

Researcher

More Details >

Gravity Forms <= 2.10.0.1 – Unauthenticated Arbitrary File Deletion

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-48866
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

Gravity Forms [gravityforms]

Researcher

More Details >

Media folder Addon <= 4.0.1 – Unauthenticated Arbitrary File Download

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-9690
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

Media folder Addon [wp-media-folder-addon]

Researcher

More Details >

Admin Columns <= 7.0.18 – Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-7654
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Admin Columns [codepress-admin-columns]

Researcher

More Details >

Booking for Appointments and Events Calendar – Amelia <= 2.3 – Authenticated (Subscriber+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-48889
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

Booking for Appointments and Events Calendar – Amelia [ameliabooking]

Researcher

More Details >

Content Visibility for Divi Builder <= 4.02 – Authenticated (Contributor+) Remote Code Execution

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-1829
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

Content Visibility for Divi Builder [content-visibility-for-divi-builder]

Researcher

More Details >

Content Visibility for Divi Builder <= 4.02 – Authenticated (Contributor+) Remote Code Execution

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-1829
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

Content Visibility for Divi Builder [content-visibility-for-divi-builder]

Researcher

More Details >

Cornerstone < 7.8.8 – Authenticated (Subscriber+) Arbitrary Code Execution

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-49113
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

Cornerstone [cornerstone]

Researcher

More Details >

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.2 – Authenticated (Customer+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-49780
Patch Status
Patched
Published
Jun 3, 2026

Affected Software

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy [dokan-lite]

Researcher

More Details >

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.1 – Authenticated (Contributor+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-49083
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

LatePoint – Calendar Booking Plugin for Appointments and Events [latepoint]

Researcher

More Details >

RD Station <= 5.6.0 – Authenticated (Contributor+) Remote Code Execution

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-49774
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

RD Station [integracao-rd-station]

Researcher

More Details >

WP Captcha PRO <= 5.38 – Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-5415
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Advanced Google reCAPTCHA [advanced-google-recaptcha]

Researcher

More Details >

WP Captcha PRO <= 5.38 – Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-5411
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Advanced Google reCAPTCHA [advanced-google-recaptcha]

Researcher

More Details >

Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms <= 1.26.13 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-49768
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms [happyforms]

Researcher

More Details >

Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-9691
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms [cf7-active-campaign]

Researcher

More Details >

Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.6 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-49106
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms [cf7-constant-contact]

Researcher

More Details >

Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.3.7 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-49763
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms [cf7-hubspot]

Researcher

More Details >

Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-49104
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms [cf7-infusionsoft]

Researcher

More Details >

Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-49765
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms [cf7-mailchimp]

Researcher

More Details >

Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-49109
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms [cf7-salesforce]

Researcher

More Details >

Moderno < 1.43 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-49108
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

Moderno – Fashion & Clothing, Furniture [moderno]

Researcher

More Details >

OttoKit: All-in-One Automation Platform <= 1.1.27 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-49781
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

OttoKit: All-in-One Automation Platform [suretriggers]

Researcher

More Details >

SlimStat Analytics < 5.4.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-27410
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

SlimStat Analytics [wp-slimstat]

Researcher

More Details >

Thrive Apprentice < 10.8.10.2 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-49107
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

Thrive Apprentice [thrive-apprentice]

Researcher

More Details >

WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-49085
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms [cf7-insightly]

Researcher

More Details >

WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.7.12 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-49770
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

WP Travel Engine – Tour Booking Plugin – Tour Operator Software [wp-travel-engine]

Researcher

More Details >

WP User Manager – User Profile Builder & Membership <= 2.9.16 – Authenticated (Subscriber+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-49766
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

WP User Manager – User Profile Builder & Membership [wp-user-manager]

Researcher

More Details >

WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-49105
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms [cf7-zendesk]

Researcher

More Details >

wpForo Forum <= 3.1.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-49769
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

wpForo Forum [wpforo]

Researcher

More Details >

Active Products Tables for WooCommerce. Use constructor to create tables  <= 1.0.9 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-42761
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

Active Products Tables for WooCommerce. Use constructor to create tables  [profit-products-tables-for-woocommerce]

Researcher

More Details >

ARMember Premium <= 7.3.1 – Unauthenticated SQL Injection via ‘order’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-5073
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup [armember]

Researcher

More Details >

GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-49776
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites [gptranslate]

Researcher

More Details >

JetSearch <= 3.5.17 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-49079
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

JetSearch [jet-search]

Researcher

More Details >

JetSmartFilters <= 3.8.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-48875
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

JetSmartFilters [jet-smart-filters]

Researcher

More Details >

JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.9 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-48886
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

JS Help Desk – AI-Powered Support & Ticketing System [js-support-ticket]

Researcher

More Details >

SP Project & Document Manager <= 4.71 – Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view_file() Function

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-10737
Patch Status
Unpatched
Published
Jun 3, 2026

Affected Software

SP Project & Document Manager [sp-client-document-manager]

Researcher

More Details >

WP User Manager <= 2.9.17 – Unauthenticated Path Traversal to Local File Inclusion via ‘tab’ Query Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-9290
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

WP User Manager – User Profile Builder & Membership [wp-user-manager]

Researcher

5b840087cae0a13b411eb404ad102a47Yat

More Details >

All-In-One Security (AIOS) <= 5.4.7 – Unauthenticated Stored Cross-Site Scripting via REST API Request Path

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-8438
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

All-In-One Security (AIOS) – Security and Firewall [all-in-one-wp-security-and-firewall]

Researcher

More Details >

AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.7.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42775
Patch Status
Patched
Published
Jun 3, 2026

Affected Software

AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress [automatorwp]

Researcher

More Details >

Booking Package <= 1.7.16 – Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-9851
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Booking Package [booking-package]

Researcher

More Details >

cformsII <= 15.1.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39435
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

cformsII [cforms2]

Researcher

More Details >

Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-49055
Patch Status
Patched
Published
Jun 3, 2026

Affected Software

Drag and Drop Multiple File Upload for Contact Form 7 [drag-and-drop-multiple-file-upload-contact-form-7]

Researcher

More Details >

Email Encoder < 0.3.12 (premium) < 1.0.25 (free) – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-5305
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

Email Address Encoder [email-address-encoder]
email-encoder-premium [email-encoder-premium]

Researcher

More Details >

FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-48966
Patch Status
Patched
Published
Jun 3, 2026

Affected Software

FunnelKit – Funnel Builder for WooCommerce Checkout [funnel-builder]

Researcher

More Details >

Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 6.1.3 – Authenticated (Author+) Server-Side Request Forgery

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-10586
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns [essential-blocks]

Researcher

More Details >

HollerBox — Fast & Effective Popups & Lead-Generation <= 2.3.10.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-48885
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

HollerBox — Fast & Effective Popups & Lead-Generation [holler-box]

Researcher

More Details >

Integration for Freshsales <= 1.0.15 – Unauthenticated Stored Cross-Site Scripting via Form Submission Data

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-8901
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More [crm-integration-freshworks-any-form]

Researcher

More Details >

MDJM Event Management <= 1.7.8.3 – Authenticated (Administrator+) Arbitrary File Upload via ‘mdjm_email_upload_file’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-7537
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

MDJM Event Management [mobile-dj-manager]

Researcher

More Details >

MW WP Form <= 5.1.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-48871
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

MW WP Form [mw-wp-form]

Researcher

More Details >

Product Filter Widget for Elementor <= 1.0.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-45437
Patch Status
Unpatched
Published
Jun 1, 2026

Affected Software

Product Filter Widget for Elementor [product-filter-widget-for-elementor]

Researcher

More Details >

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 11.1.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-48867
Patch Status
Patched
Published
Jun 3, 2026

Affected Software

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker [quiz-master-next]

Researcher

More Details >

Stop Spammers Classic <= 2026.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-48876
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

Stop Spammers Classic [stop-spammer-registrations-plugin]

Researcher

More Details >

VikBooking Hotel Booking Engine & PMS <= 1.8.9 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42762
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

VikBooking Hotel Booking Engine & PMS [vikbooking]

Researcher

More Details >

WP Google Review Slider <= 17.9 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39451
Patch Status
Unpatched
Published
Jun 1, 2026

Affected Software

WP Google Review Slider [wp-google-places-review-slider]

Researcher

More Details >

WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-48839
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

WP Statistics – Simple, privacy-friendly Google Analytics alternative [wp-statistics]

Researcher

More Details >

WPFunnels Pro <= 2.9.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-49778
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

WPFunnels Pro [wpfunnels-pro]

Researcher

More Details >

LearnPress – Backup & Migration Tool <= 4.1.4 – Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-7566
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

LearnPress – Backup & Migration Tool [learnpress-import-export]

Researcher

More Details >

ARMember Premium <= 7.3.1 – Authenticated (Subscriber+) SQL Injection via ‘sSortDir_0’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-5074
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup [armember]

Researcher

More Details >

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-48964
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

ELEX WordPress HelpDesk & Customer Ticketing System [elex-helpdesk-customer-support-ticket-system]

Researcher

More Details >

GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.8.7 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-48874
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress [gamipress]

Researcher

More Details >

Geo Mashup <= 1.13.19 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-48967
Patch Status
Patched
Published
Jun 3, 2026

Affected Software

Geo Mashup [geo-mashup]

Researcher

More Details >

MasterStudy LMS Pro Plus <= 4.8.20 – Authenticated (Instructor+) SQL Injection via ‘columns’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-8653
Patch Status
Patched
Published
Jun 3, 2026

Affected Software

MasterStudy LMS Pro [masterstudy-lms-learning-management-system-pro]

Researcher

More Details >

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.41 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-49771
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]

Researcher

More Details >

Photo Gallery by 10Web <= 1.8.41 – Authenticated (Contributor+) SQL Injection via ‘compact_album_order_by’ Shortcode Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-9829
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]

Researcher

More Details >

WP Time Slots Booking Form <= 1.2.50 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-48882
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

WP Time Slots Booking Form [wp-time-slots-booking-form]

Researcher

More Details >

Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) <= 4.9 – Authenticated (Author+) Stored Cross-Site Scripting via Image Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-3722
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) [auto-image-attributes-from-filename-with-bulk-updater]

Researcher

More Details >

Click to Chat <= 4.39 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘num’ Shortcode Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-7795
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Click to Chat – HoliThemes [click-to-chat-for-whatsapp]

Researcher

More Details >

DeMomentSomTres Shortcodes <= 1.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8885
Patch Status
Unpatched
Published
Jun 1, 2026

Affected Software

DeMomentSomTres Shortcodes [demomentsomtres-shortcodes]

Researcher

More Details >

Easy Cart <= 1.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-4080
Patch Status
Unpatched
Published
Jun 1, 2026

Affected Software

Easy Cart [easy-cart]

Researcher

More Details >

EmbedPress <= 4.5.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Block ‘url’ Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-7796
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more [embedpress]

Researcher

5a50351dc3a5975487697a55ad3936d5UKO

More Details >

Express Payment For Stripe <= 1.28.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8893
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Express Payment For Stripe [wp-stripe-express]

Researcher

More Details >

FPW Category Thumbnails <= 1.9.5 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘id’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-2382
Patch Status
Unpatched
Published
Jun 1, 2026

Affected Software

FPW Category Thumbnails [fpw-category-thumbnails]

Researcher

More Details >

FV Flowplayer Video Player < 7.5.51.7212 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-49773
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

FV Flowplayer Video Player [fv-wordpress-flowplayer]

Researcher

More Details >

King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder <= 51.1.62 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-48870
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder [king-addons]

Researcher

More Details >

Master Addons For Elementor <= 3.1.0 – Authenticated (Author+) Stored Cross-Site Scripting via ‘jtlma_custom_js’ Page Setting (Custom JS Extension)

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-9281
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits [master-addons]

Researchers

More Details >

Recipe Card Blocks Lite <= 3.4.13 – Authenticated (Author+) Stored Cross-Site Scripting via ‘summary’ and ‘notes’

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-3011
Patch Status
Patched
Published
Jun 7, 2026

Affected Software

Recipe Card Blocks Lite [recipe-card-blocks-by-wpzoom]

Researchers

More Details >

Simple SEO Slideshow <= 1.2.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8900
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Simple SEO Slideshow [simple-seo-slideshow]

Researcher

More Details >

WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.2 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-48880
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

WP Job Portal – AI-Powered Recruitment System for Company or Job Board website [wp-job-portal]

Researcher

More Details >

ZeM STL <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-4081
Patch Status
Unpatched
Published
Jun 1, 2026

Affected Software

ZeM STL [zem-stl-viewer]

Researcher

More Details >

Ad Inserter <= 2.8.15 – Reflected Cross-Site Scripting via URL Parameters in iframe Mode

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-9280
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]

Researcher

More Details >

Enfold – Responsive Multi-Purpose Theme <= 7.1.4 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-48869
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

enfold [enfold]

Researcher

More Details >

hiWeb Migration Simple <= 2.0.0.1 – Reflected Cross-Site Scripting via ‘new_domain’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-2425
Patch Status
Unpatched
Published
Jun 1, 2026

Affected Software

hiWeb Migration Simple [hiweb-migration-simple]

Researcher

More Details >

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.6 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-48865
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

rognone <= 0.6.2 – Reflected Cross-Site Scripting via ‘a’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-1451
Patch Status
Unpatched
Published
Jun 1, 2026

Affected Software

rognone [rognone]

Researcher

More Details >

rognone <= 0.6.2 – Reflected Cross-Site Scripting via ‘mode’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-1450
Patch Status
Unpatched
Published
Jun 1, 2026

Affected Software

rognone [rognone]

Researcher

More Details >

wp-nano-ad <= 1.31 – Authenticated (Administrator+) Stored Cross-Site Scripting via blogrole_link Parameter

5.5

CVSS Rating
5.5 (Medium)
CVE-ID

CVE-2025-5085
Patch Status
Unpatched
Published
Jun 1, 2026

Affected Software

WP Nano AD [wp-nano-ad]

Researcher

More Details >

Tiled Gallery Carousel Without JetPack <= 3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘data-image-title’

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-5191
Patch Status
Unpatched
Published
Jun 1, 2026

Affected Software

Tiled Gallery Carousel Without JetPack [tiled-gallery-carousel-without-jetpack]

Researcher

More Details >

10WebAdManager <= 1.0.11 – Unauthenticated Arbitrary File Download

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2019-25727
Patch Status
Unpatched
Published
Jun 5, 2026

Affected Software

10WebAdManager [ad-manager-wd]

Researcher(s): Unknown

More Details >

Booknetic <= 4.8.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-25439
Patch Status
Unpatched
Published
Jun 1, 2026

Affected Software

Booknetic [booknetic]

Researcher

More Details >

Debug Log Manager <= 2.5.0 – Unauthenticated Improper Output Neutralization for Logs via log_js_errors AJAX Action

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9016
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Debug Log Manager – Conveniently Monitor and Inspect Errors [debug-log-manager]

Researcher

More Details >

EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more <= 4.5.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-48872
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more [embedpress]

Researcher

More Details >

Essential Addons for Elementor <= 6.6.4 – Missing Authorization to Unauthenticated Information Exposure via ‘load_more’ AJAX Handler

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-7665
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]

Researcher

More Details >

Event Monster <= 2.1.0 – Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via em_capture_payment AJAX Action

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-8608
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Event Monster – Event Manager, Ticket Booking & Registration [event-monster]

Researcher

More Details >

Hybrid Composer <= 1.4.6 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2019-25738
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Hybrid Composer [hybrid-composer]

Researcher(s): Unknown

More Details >

JobSearch WP Job Board <= 3.2.7 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49057
Patch Status
Patched
Published
Jun 3, 2026

Affected Software

JobSearch WP Job Board [wp-jobsearch]

Researcher

More Details >

JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.9 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-48887
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

JS Help Desk – AI-Powered Support & Ticketing System [js-support-ticket]

Researcher

5703ccf58e200369a20009dd05f3c424Nvz

More Details >

LearnPress <= 4.3.6 – Unauthenticated Sensitive Information Exposure via ‘c_status’ and ‘return_type’ Parameters

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-8502
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

MapPress Maps for WordPress <= 2.96.6 – Unauthenticated Insecure Direct Object Reference via REST API Endpoints

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-8839
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

MapPress Maps for WordPress [mappress-google-maps-for-wordpress]

Researcher

More Details >

Montonio for WooCommerce <= 10.1.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-48873
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

Montonio for WooCommerce [montonio-for-woocommerce]

Researcher

More Details >

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.5.10 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-48970
Patch Status
Patched
Published
Jun 3, 2026

Affected Software

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) [really-simple-ssl]

Researcher

More Details >

RegistrationMagic – User Registration Forms Plugin <= 6.0.8.6 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49764
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

RegistrationMagic – User Registration Forms Plugin [custom-registration-form-builder-with-submission-manager]

Researcher

More Details >

Shared Files – Frontend File Upload Form & Secure File Sharing <= 1.7.64 – Unauthenticated Path Traversal

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49112
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Shared Files – Frontend File Upload Form & Secure File Sharing [shared-files]

Researcher

More Details >

Simple Shopping Cart <= 5.2.9 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-48868
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

Simple Shopping Cart [wordpress-simple-paypal-shopping-cart]

Researcher

More Details >

Travelly – Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Solution <= 2.1.7 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-27089
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

Travelly – Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Solution [tour-booking-manager]

Researcher

More Details >

TrueBooker – Appointment Booking and Scheduler System <= 1.1.9 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-48881
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]

Researcher

More Details >

Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. <= 3.1.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49110
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. [upsell-order-bump-offer-for-woocommerce]

Researcher

More Details >

User Registration Stripe <= 1.3.12 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49081
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

User Registration Stripe [user-registration-stripe]

Researcher

More Details >

WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.4 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49056
Patch Status
Patched
Published
Jun 3, 2026

Affected Software

WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels [print-invoices-packing-slip-labels-for-woocommerce]

Researcher

More Details >

Welcart e-Commerce <= 2.11.28 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49775
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

Welcart e-Commerce [usc-e-shop]

Researcher

More Details >

Wp EMember <= v10.2.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49077
Patch Status
Unpatched
Published
Jun 4, 2026

Affected Software

Wp EMember [wp-eMember]

Researcher

More Details >

WP Go Maps < 10.0.10 – Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-8385
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

WP Go Maps – Google Maps, OpenStreetMap, Leaflet Map [wp-google-maps]

Researcher

More Details >

WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.7.10 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49078
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

WP Travel Engine – Tour Booking Plugin – Tour Operator Software [wp-travel-engine]

Researcher

More Details >

WPC Product Bundles for WooCommerce <= 8.5.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-48883
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

WPC Product Bundles for WooCommerce [woo-product-bundle]

Researcher

More Details >

WPForms <= 1.10.0.4 – Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-7792
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More [wpforms-lite]

Researcher

More Details >

wpForo Forum <= 3.1.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49767
Patch Status
Patched
Published
Jun 4, 2026

Affected Software

wpForo Forum [wpforo]

Researcher

More Details >

LearnPress <= 4.1.4 – Authenticated (Administrator+) Path Traversal to Arbitrary File Read via ‘import-user-file’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-7565
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

LearnPress – Backup & Migration Tool [learnpress-import-export]

Researcher

More Details >

OptinCraft <= 1.2.0 – Authenticated (Administrator+) SQL Injection via ‘order_by’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-8978
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

OptinCraft – Drag & Drop Optins & Popup Builder for WordPress [optincraft]

Researcher

More Details >

Quiz and Survey Master (QSM) <= 11.1.2 – Authenticated (Admin+) SQL Injection via ‘order’ and ‘limit’ Parameters

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-6448
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker [quiz-master-next]

Researcher

More Details >

Smart Slider 3 <= 3.5.1.36 – Authenticated (Administrator+) Path Traversal to Arbitrary File Read via ‘src’/’srcset’ Attribute in HTML Export

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-9197
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Smart Slider 3 [smart-slider-3]

Researcher

More Details >

Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘drag_n_drop_text’ and ‘drag_n_drop_browse_text’ Settings

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-8991
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Drag and Drop Multiple File Upload for Contact Form 7 [drag-and-drop-multiple-file-upload-contact-form-7]

Researcher

More Details >

Passeum Ticketing <= 1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘shop_name’ Setting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-7421
Patch Status
Unpatched
Published
Jun 2, 2026

Affected Software

Passeum Ticketing [passeum-ticketing]

Researcher

More Details >

Progress Planner <= 1.9.0 – Authenticated (Editor+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-28116
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

Progress Planner [progress-planner]

Researcher

More Details >

Quick Playground <= 1.3.4 – Authenticated (Administrator+) Arbitrary File Read via ‘filename’ Parameter

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-2500
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Quick Playground [quick-playground]

Researcher

More Details >

Simple Custom Login Page <= 1.0.3 – Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-10100
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

Simple Custom Login Page [simple-custom-login-page]

Researcher

More Details >

Word Replacer <= 0.4 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘Replacement’ Parameter

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-3620
Patch Status
Unpatched
Published
Jun 1, 2026

Affected Software

Word Replacer [word-replacer]

Researcher

More Details >

WP Maps <= 4.9.4 – Authenticated (Admin+) Stored Cross-Site Scripting via ‘location_messages’ Parameter

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-9594
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters [wp-google-map-plugin]

Researcher

More Details >

Alba Board <= 2.1.3 – Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via ‘card_id’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-7523
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Alba Board [alba-board]

Researcher

More Details >

Backup, Restore and Migrate your sites with XCloner <= 4.8.6 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-48965
Patch Status
Patched
Published
Jun 3, 2026

Affected Software

Backup, Restore and Migrate your sites with XCloner [xcloner-backup-and-restore]

Researcher

More Details >

BirdSeed <= 2.2.0 – Cross-Site Request Forgery via BirdSeed Token Change

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-4071
Patch Status
Unpatched
Published
Jun 1, 2026

Affected Software

BirdSeed [birdseed]

Researcher

More Details >

Charitable <= 1.8.11.1 – Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via ‘avatar’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-10038
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More [charitable]

Researcher

More Details >

Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons <= 1.4.8 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-49082
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons [chatway-live-chat]

Researcher

More Details >

Elementor Website Builder – more than just a page builder <= 4.1.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-49782
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

Elementor Website Builder – more than just a page builder [elementor]

Researcher

More Details >

EmergencyWP <= 1.4.2 – Cross-Site Request Forgery to Plugin Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9732
Patch Status
Unpatched
Published
Jun 2, 2026

Affected Software

EmergencyWP – Dead Man’s switch & legacy deliverance [emergencywp]

Researcher

More Details >

Employee, Leave and Recruitment Management System – Crew HRM <= 1.2.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-27351
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

Employee, Leave and Recruitment Management System – Crew HRM [hr-management]

Researcher

More Details >

Frontend User Notes <= 2.1.1 – Cross-Site Request Forgery to Note Content Modification via ‘confirmEdit’ Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-7047
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Frontend User Notes [frontend-user-notes]

Researcher

More Details >

Google Plus One Bottom <= 0.0.2 – Cross-Site Request Forgery to Plugin Settings Update via Settings Page

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9723
Patch Status
Unpatched
Published
Jun 1, 2026

Affected Software

Google Plus One Bottom [google-plus-one-bottom]

Researcher

More Details >

JTL-Connector for WooCommerce <= 2.4.1 – Missing Authorization to Authenticated (Subscriber+) Settings Modification via Multiple Functions

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9234
Patch Status
Unpatched
Published
Jun 1, 2026

Affected Software

JTL-Connector for WooCommerce [woo-jtl-connector]

Researcher

More Details >

Klamra Paycal for Aspaclaria <= 1.1.4 – Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via ‘invoice_id’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8611
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Klamra Paycal for Aspaclaria [klamra-paycal-for-aspaclaria]

Researcher

More Details >

Laiser Tag <= 1.2.5 – Cross-Site Request Forgery to Plugin Settings Update via Settings Form

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9722
Patch Status
Unpatched
Published
Jun 1, 2026

Affected Software

Laiser Tag [laiser-tag]

Researcher

More Details >

LatePoint <= 5.6.0 – Cross-Site Request Forgery via invoices__change_status Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9719
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

LatePoint – Calendar Booking Plugin for Appointments and Events [latepoint]

Researcher

More Details >

Page-list <= 6.2 – Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode Attributes

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9008
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

Page-list [page-list]

Researcher

More Details >

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-34892
Patch Status
Patched
Published
Jun 3, 2026

Affected Software

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]

Researcher

More Details >

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.5.9 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-48969
Patch Status
Patched
Published
Jun 3, 2026

Affected Software

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) [really-simple-ssl]

Researcher

More Details >

Remove meta boxes per user role <= 1.01 – Cross-Site Request Forgery to Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8422
Patch Status
Unpatched
Published
Jun 1, 2026

Affected Software

Remove meta boxes per user role [remove-meta-boxes-per-user-role]

Researcher

More Details >

Remove NoFollow Commenter URL <= 1.0 – Cross-Site Request Forgery to Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9730
Patch Status
Unpatched
Published
Jun 1, 2026

Affected Software

Remove NoFollow Commenter URL [remove-nofollow-commenter-link]

Researcher

More Details >

RSS Aggregator by Feedzy <= 5.1.7 – Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8976
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator [feedzy-rss-feeds]

Researcher

More Details >

SEO Plugin by Squirrly SEO <= 12.4.16 – Missing Authorization to Authenticated (Contributor+) Privileged Cloud API Operations

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-7624
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

SEO Plugin by Squirrly SEO [squirrly-seo]

Researcher

More Details >

Slider Revolution 6.0.0-6.7.55 and 7.0.0-7.0.14 – Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Deactivation

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9050
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

Slider Revolution [revslider]

Researcher

More Details >

Slider Revolution 7.0.0 – 7.0.14 – Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9048
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

Slider Revolution [revslider]

Researcher

More Details >

Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions <= 8.4.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-42378
Patch Status
Patched
Published
Jun 1, 2026

Affected Software

Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions [wp-full-stripe-free]

Researcher

More Details >

Tectite Forms <= 1.3 – Cross-Site Request Forgery to Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9599
Patch Status
Unpatched
Published
Jun 1, 2026

Affected Software

Tectite Forms [tectite-forms]

Researcher

More Details >

Visual Link Preview <= 2.4.1 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-48878
Patch Status
Patched
Published
Jun 2, 2026

Affected Software

Visual Link Preview [visual-link-preview]

Researcher

More Details >

Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.128 – Authenticated (Admin+) Arbitrary Directory Deletion

3.8

CVSS Rating
3.8 (Low)
CVE-ID

CVE-2025-12656
Patch Status
Patched
Published
Jun 5, 2026

Affected Software

WPvivid — Backup, Migration & Staging [wpvivid-backuprestore]

Researcher

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (June 1, 2026 to June 7, 2026) appeared first on Wordfence.

]]> Critical Unauthenticated Authentication Bypass Vulnerability Patched in UpdraftPlus WordPress Plugin https://swiftupdates.ca/critical-unauthenticated-authentication-bypass-vulnerability-patched-in-updraftplus-wordpress-plugin/ Wed, 10 Jun 2026 18:39:03 +0000 https://swiftupdates.ca/critical-unauthenticated-authentication-bypass-vulnerability-patched-in-updraftplus-wordpress-plugin/ On June 2nd, 2026, we received a submission for a critical Unauthenticated Authentication Bypass vulnerability in UpdraftPlus, a WordPress plugin with more than 3 million active installations. Although the plugin has such a large install base, the vulnerability is only exploitable on sites that have previously been connected to UpdraftCentral, the plugin’s remote site management dashboard. On affected sites, this vulnerability allows unauthenticated attackers to run arbitrary Remote Procedure Calls (RPC) as the connected administrator, for example, uploading and activating a malicious plugin, resulting in arbitrary PHP code execution and complete site compromise.

Props to vtim who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $5,200.00 for this discovery. Our mission is to secure WordPress through defense in depth, which is why we are investing in quality vulnerability research and collaborating with researchers of this caliber through our Bug Bounty Program. We are committed to making the WordPress ecosystem more secure through the detection and prevention of vulnerabilities, which is a critical element to the multi-layered approach to security.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against any exploits targeting this vulnerability on June 3, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later on July 3, 2026.

We provided full disclosure details to the UpdraftPlus team through our Wordfence Vulnerability Management Portal on June 3, 2026. The developer acknowledged the report on June 4, 2026, and released the fully patched version on June 5, 2026. We would like to commend the UpdraftPlus team for their prompt response and timely patch.

We urge users to update their sites to the latest patched version of UpdraftPlus as soon as possible.

Vulnerability Summary from Wordfence Intelligence

UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 – Unauthenticated Authentication Bypass via UpdraftCentral udrpc

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-10795
Affected Version(s)
<= 1.26.4
Patched Version
1.26.5

Affected Software

UpdraftPlus: WP Backup & Migration Plugin [updraftplus]

Researcher

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.

More Details >

Technical Analysis

UpdraftPlus is a popular WordPress plugin for creating backups, as well as migration, and remote site management. It optionally integrates with UpdraftCentral, a centralized site management dashboard available both as a hosted cloud service and as a self-hosted product, allowing administrators to manage multiple WordPress sites from a single interface.

To support this integration, UpdraftPlus bundles a remote communications library that, once a site has been connected to UpdraftCentral, registers an unauthenticated RPC listener on every page load. This listener accepts POST requests containing a serialized udrpc_message and dispatches the decoded command on behalf of the connecting administrator.

Once the listener has decided to process the message, it calls the decrypt_message() function from the UpdraftPlus_Remote_Communications_V2 class, which extracts the base64-encoded encrypted symmetric key portion from the message, attempts to decrypt it with the site’s local RSA private key, and then uses the result directly as the AES key for decrypting the message body.

public function decrypt_message($message) {

	if (!$this->key_local) throw new Exception('No decryption key has been set');

	$rsa = new phpseclib_Crypt_RSA();
	if (defined('UDRPC_PHPSECLIB_ENCRYPTION_MODE')) $rsa->setEncryptionMode(UDRPC_PHPSECLIB_ENCRYPTION_MODE);
	// Defaults to CRYPT_AES_MODE_CBC
	$rij = new phpseclib_Crypt_Rijndael();

	// Extract the Symmetric Key
	$len = substr($message, 0, 3);
	$len = hexdec($len);
	$sym_key = substr($message, 3, $len);

	// Extract the encrypted message
	$cipherlen = substr($message, ($len + 3), 16);
	$cipherlen = hexdec($cipherlen);

	$ciphertext = substr($message, ($len + 19), $cipherlen);
	$ciphertext = base64_decode($ciphertext);

	// Decrypt the encrypted symmetric key
	$rsa->loadKey($this->key_local);
	$sym_key = base64_decode($sym_key);
	$sym_key = $rsa->decrypt($sym_key);

	// Decrypt the message
	$rij->setKey($sym_key);

	return $rij->decrypt($ciphertext);

}

Unfortunately, the function does not check the return value of $rsa->decrypt(). When the supplied encrypted key is malformed, phpseclib’s RSA::decrypt() returns false rather than throwing an exception. Passing false to Rijndael::setKey() collapses to a deterministic cipher with an all-zero AES-128 key, an all-zero initialization vector, and PKCS7 padding. An attacker can reproduce this exact configuration locally, encrypt a message of their choosing, and have the server successfully decrypt it without ever needing access to the site’s keys.

This means that an unauthenticated attacker can craft a fully forged udrpc_message that the listener accepts and dispatches as if it had been signed and encrypted by the connected UpdraftCentral dashboard.

When the dispatcher hands the message off to the UpdraftCentral listener in UpdraftCentral_Listener::udrpc_action(), it calls wp_set_current_user() with the user ID of the administrator who originally connected the site to UpdraftCentral. From that point on, every WordPress capability check sees the request as coming from a fully authenticated administrator.

UpdraftPlus implements a number of powerful RPC commands, for example, plugin.upload_plugin, which writes an arbitrary plugin ZIP to disk via file_put_contents() and installs it through Plugin_Upgrader::install(), and plugin.activate_plugin, which activates the newly installed plugin. By uploading a plugin that contains a simple PHP webshell, an attacker can gain arbitrary PHP and operating system command execution.

The Patch

The vendor addressed this issue by adding a return-value check to the decrypt_message() function.

public function decrypt_message($message) {

	if (!$this->key_local) throw new Exception('No decryption key has been set');

	$rsa = new phpseclib_Crypt_RSA();
	if (defined('UDRPC_PHPSECLIB_ENCRYPTION_MODE')) $rsa->setEncryptionMode(UDRPC_PHPSECLIB_ENCRYPTION_MODE);
	// Defaults to CRYPT_AES_MODE_CBC
	$rij = new phpseclib_Crypt_Rijndael();

	// Extract the Symmetric Key
	$len = substr($message, 0, 3);
	$len = hexdec($len);
	$sym_key = substr($message, 3, $len);

	// Extract the encrypted message
	$cipherlen = substr($message, ($len + 3), 16);
	$cipherlen = hexdec($cipherlen);

	$ciphertext = substr($message, ($len + 19), $cipherlen);
	$ciphertext = base64_decode($ciphertext);

	// Decrypt the encrypted symmetric key
	$rsa->loadKey($this->key_local);
	$sym_key = base64_decode($sym_key);
	$sym_key = $rsa->decrypt($sym_key);

	if (false === $sym_key || !is_string($sym_key) || strlen($sym_key) < 16) {
		return false;
	}

	// Decrypt the message
	$rij->setKey($sym_key);

	return $rij->decrypt($ciphertext);

}

Wordfence Firewall

The following graphic demonstrates the steps to exploitation an attacker might take and at which point the Wordfence firewall would block an attacker from successfully exploiting the vulnerability.

updraftplus rc howto wordfence firewall

Disclosure Timeline

June 1, 2026 – We received the submission for the Unauthenticated Authentication Bypass vulnerability in UpdraftPlus via the Wordfence Bug Bounty Program.
June 3, 2026 – We validated the report and confirmed the proof-of-concept exploit. Full disclosure details were sent instantly to the vendor through our Wordfence Vulnerability Management Portal.
June 3, 2026 – Wordfence Premium, Care, and Response users received a firewall rule to provide added protection against any exploits that may target this vulnerability.
June 4, 2026 – The vendor acknowledged the report and began working on a fix.
June 5, 2026 – The fully patched version of the plugin, 1.26.5, was released.
July 3, 2026 – Wordfence Free users will receive the same protection.

Conclusion

In this blog post, we detailed a critical Unauthenticated Authentication Bypass vulnerability within the UpdraftPlus plugin affecting all versions up to, and including, 1.26.4. This vulnerability allows unauthenticated threat actors to execute arbitrary code on the server when the site has previously been connected to an UpdraftCentral dashboard, by combining a bypassable signature check with a failed-decryption fallback that collapses to a deterministic all-zero AES key. The vulnerability has been fully addressed in version 1.26.5 of the plugin.

We encourage WordPress users to verify that their sites are updated to the latest patched version of UpdraftPlus as soon as possible considering the critical nature of this vulnerability.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against any exploits targeting this vulnerability on June 3, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later on July 3, 2026.

If you know someone who uses this plugin on their site, we recommend sharing this advisory with them to ensure their site remains secure, as this vulnerability poses a significant risk.

The post Critical Unauthenticated Authentication Bypass Vulnerability Patched in UpdraftPlus WordPress Plugin appeared first on Wordfence.

]]> Quarterly WordPress Threat Intelligence Report – Q1 2026 https://swiftupdates.ca/quarterly-wordpress-threat-intelligence-report-q1-2026/ Thu, 04 Jun 2026 21:42:49 +0000 https://swiftupdates.ca/quarterly-wordpress-threat-intelligence-report-q1-2026/

As the leader in WordPress security, Wordfence provides unparalleled security coverage that fully encompasses protection, active monitoring, detection, and response all built around our threat intelligence, demonstrating a strong commitment to security. Our mission is to ensure comprehensive defense-in-depth for every layer of a WordPress website’s security.

It’s important to understand that a complete security solution requires both protection and detection; while protection is crucial for preventing initial compromises, detection is equally vital for a wholesome WordPress site security strategy.

📢 There’s a Wordfence Option for Every Site Owner

Whether you run a personal blog or manage hundreds of client websites, Wordfence has a plan tailored to your needs:

Wordfence Free – Industry-leading Web Application Firewall (WAF) blocking 95% of known threats out of the box, malware scanning, Two-Factor Authentication (2FA), and more. 30-day delay on malware signatures and new firewall rules.

Wordfence Premium – Real-time firewall and malware signature updates, plus powerful tools like an audit log for deeper insight and monitoring.

Wordfence Care – Around-the-clock monitoring by our team, hands-on remediation if something goes wrong, and priority support for true peace of mind.

Wordfence Response – All the benefits of Wordfence Premium and Care with one hour response times for immediate remediation of security breaches.

👉 Compare Plans

This regular report highlights trends and changes in the WordPress security landscape, empowering you as a site owner to proactively protect your website against current vulnerabilities and threats, and to better understand the protections Wordfence provides through it’s robust threat intelligence.

Threat Intelligence Key Highlights Q1 2026

As the industry leader in WordPress security we have access to attack telemetry and vulnerability intelligence that no other security provider can compare to. We know exactly what vulnerabilities will become a target for threats, what the biggest threats to WordPress are, and how to prioritize remediation and protection against WordPress. The following presents some key highlights of WordPress threats and vulnerabilities in Q1 2026.

Total Vulnerabilities Published
2,738
+23.7% from previous quarter
High Threat Vulnerabilities
158
+20.6% from previous quarter
Common & Dangerous Vulnerabilities
198
+98.0% from previous quarter
WAF Attacks Blocked
9.1B
-0.3% from previous quarter
Brute Force Attacks Blocked
16.0B
+15.3% from previous quarter
Sites Infected
474K
+1.4% from previous quarter
👉 What this means for site owners: Keep plugins and themes updated regularly, enable 2FA, run regular security scans, follow strong password security, and rely on a WAF like Wordfence for protection before vulnerabilities are patched and continuous monitoring.

Wordfence Vulnerability Intelligence Highlights for Q1 2026

This section breaks down the vulnerabilities disclosed in Q1 2026 along with highlighting any trends or changes from the previous quarter.

The Wordfence Bug Bounty Program’s primary mission is to attract the highest quality vulnerability research in the WordPress space based on high impact and high severity vulnerabilities that are the most likely to be exploited. Due to this, you can rest assured knowing that you have the best protection available for vulnerabilities that pose the most significant risk to your site before they are even disclosed to the vendor.

Did you know? Wordfence provides the most comprehensive vulnerability intelligence for WordPress, with over 29,000 known vulnerabilities cataloged in our database. Our team adds dozens to hundreds of new vulnerabilities every week, ensuring the Wordfence plugin’s vulnerability scanner, and our free Vulnerability Intelligence API, alert you the moment a new vulnerability is detected.

Total Vulnerabilities Published
2,738
+23.7% from previous quarter
Total WAF Rules Released
22
+10.0% from previous quarter

Total Vulnerabilities Published

In Q1, there were 2,738 vulnerabilities added to the Wordfence Intelligence vulnerability database. Wordfence was responsible for remediating and disclosing 37.2% of the total. The following chart highlights the trend in new vulnerabilities disclosed over this period.

Total Vulnerabilities Published By Month

Total High Threat Vulnerabilities Published

In Q1, there were 158 high threat vulnerabilities added to the Wordfence Intelligence vulnerability database. These vulnerabilities pose the most significant threat to WordPress websites as attackers are very likely to target them in the real-world, and they can generally lead to full site compromise with minimal requirements. Often generic, or non-WordPress specific firewalls do not provide adequate protection against these vulnerabilities. Wordfence was the source of disclosure for 46.8% of those vulnerabilities, highlighting how the Wordfence firewall can provide you with the fastest protection for WordPress vulnerabilities that pose the most significant risk to your WordPress site.

Total High Threat Vulnerabilities Published By Month

Total Common and Dangerous Vulnerabilities Published

In Q1, there were 198 common and dangerous vulnerabilities added to the Wordfence Intelligence vulnerability database. Wordfence was responsible for remediating and disclosing 44.4% of these common and dangerous vulnerabilities. These vulnerabilities are some of the most commonly found in WordPress plugins and themes, but are still prime targets for attackers who are looking for low hanging fruit to exploit.

Total C&D Vulnerabilities Published By Month

Patch Status of Reported Vulnerabilities

At the end of Q1, there were 747 vulnerabilities that remained unpatched. This highlights the importance of utilizing a security scanner like Wordfence that will alert you when an unpatched vulnerability is present on your site so you can take remedial action, like removing the software, immediately.

Patch Status

Install Count Distribution of Affected Software

The following highlights the average distribution of install counts for software affected by vulnerabilities reported in this quarter.

Install Count Distribution of Published Vulnerabilities

Authentication Level To Exploit Distribution

Most vulnerabilities disclosed in Q1 required unauthenticated access to exploit. This is the same as from Q4 2025 where was required to exploit for the majority of vulnerabilities published.

Authentication Level Distribution of Published Vulnerabilities

Affected Software Type Distribution (Plugins/Themes/Core)

As usual, the majority of the vulnerabilities disclosed in Q1 were plugin related vulnerabilities.

Software Type Distribution of Published Vulnerabilities

Top 10 Vulnerability Classes Published

The following highlights the most commonly published vulnerabilities in Q1 2026.

Vulnerability Type Total Vulns
CWE 862: Missing Authorization 753
CWE 79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 736
CWE 98: Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 349
CWE 89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 147
CWE 352: Cross-Site Request Forgery (CSRF) 129
CWE 502: Deserialization of Untrusted Data 106
CWE 200: Exposure of Sensitive Information to an Unauthorized Actor 84
CWE 639: Authorization Bypass Through User-Controlled Key 77
CWE 22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 58
CWE 918: Server-Side Request Forgery (SSRF) 52

Vendors Registered for the Vulnerability Management Portal

This quarter, we had 151 vendors sign up to manage their WordPress software’s security through the Vulnerability Management Portal (-24.9% from previous quarter). This covers 554 distinct plugins and themes (-60.2% from previous quarter). Vendors who register for the Wordfence Vulnerability Management Portal demonstrate a strong commitment to WordPress security as they are notified in real-time when a new vulnerability has been discovered or reported in their software. If you’re a WordPress vendor and you’d like to sign up for real-time vulnerability alerts and centralized vulnerability management, get started here.

Total Vendors Registered Over Period
Total Plugins/Themes Registered Over Period

Wordfence Threat Intelligence Summary for Q1 2026

This section highlights the past quarter’s trend among vulnerabilities attackers are targeting and password attacks they are initiating.

Threat intelligence is at the heart of Wordfence’s industry-leading security solutions. As the largest security provider for WordPress, we collect and analyze attack telemetry from millions of sites worldwide. This unparalleled visibility gives us real-time insight into what attackers are targeting and when, empowering us to deliver the fastest and most effective protection for WordPress.

Web Application Firewall (WAF) Attack Data Highlights

Did you know? Wordfence leverages attack telemetry from over 5 million protected websites to continuously strengthen the security features of the Wordfence plugin. Sites running Wordfence Premium, Care, or Response automatically block IP addresses actively engaged in malicious activity across WordPress, even when those attacks don’t target a known vulnerability, keeping your site safe from the latest and emerging threats.

WAF Rule Requests Blocked/Logged
9.1B
-0.3% from previous quarter
Blocked From IP Threat Feed
3.4B
+42.5% from previous quarter
Total WAF Rules Released
22
+10.0% from previous quarter
Unique IPs in WAF Attacks
16.9M
+35.3% from previous quarter
Unique IPs From Blocklist
222K
+19.8% from previous quarter
Unique User Agents
20.0M
-8.1% from previous quarter

Total Requests Blocked and Logged by the Wordfence Firewall Over Q1

The following chart highlights how many exploit and probing requests the Wordfence Firewall has blocked over the course of Q1.

WAF Rule Attacks Blocked Over Period

Top 10 User Agents Engaged in Exploiting Vulnerabilities

The following chart highlights the top 10 user agents that have been used in exploit and enumeration attempts across the network of sites we protect.

Total Requests User Agents
882,234,754 Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
828,547,430 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
456,134,596 Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
333,417,068 curl/8.7.1
299,508,291 curl/8.7.1
276,445,415 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
213,287,827 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
169,342,546 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 BitSightBot/1.0
83,261,420 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
81,694,416 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

 

Top 10 Unique Vulnerabilities Targeted by Attackers

The following section highlights the top 10 unique vulnerabilities being targeted by attackers.

Vulnerability Total Blocked Requests
SureTriggers <= 1.0.78 – Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation 10,236,067
WooCommerce Payments 4.8.0 – 5.6.1 Authentication Bypass and Privilege Escalation 6,729,865
Rank Math SEO <= 1.0.40.2 – Privilege Escalation via Unprotected REST API Endpoint 6,211,916
Gwolle Guestbook <= 1.5.3 – Remote File Inclusion 5,809,543
WP Freeio <= 1.2.21 – Unauthenticated Privilege Escalation 4,364,204
Discount Rules for WooCommerce <= 2.0.2 – Missing Authorization 4,140,826
FULL – Customer <= 2.2.3 – Authenticated(Subscriber+) Improper Authorization to Arbitrary Plugin Installation 3,649,846
Alone Theme <= 7.8.3 – Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation 3,201,677
HT Mega – Absolute Addons for Elementor <= 2.2.0 – Missing Authorization to Privilege Escalation 3,193,007
Hunk Companion <= 1.8.4 – Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation 2,596,259

 

Top 10 Attacking Countries

The following section highlights the top 10 countries engaged in initiating attacks against WordPress websites.

Top Attacking Countries

Top 10 Attacking IP Addresses

The following are the top 10 IP Addresses engaged in targeting WordPress website vulnerabilities.

IP Address Total Requests
185.177.72.49 71,304,777
185.177.72.22 71,162,291
185.177.72.51 70,526,116
185.177.72.13 70,515,278
185.177.72.56 70,477,684
185.177.72.38 70,331,546
185.177.72.30 69,897,007
185.177.72.52 69,837,067
185.177.72.23 68,446,916
64.188.91.57 43,313,511

 

Top 5 “Generic” Vulnerability Types Targeted By Attackers

This section highlights the most attacked common vulnerability types.

Top 5 Blocked Generic WAF Rules

Password Attacks Data Highlights

Did you know? Wordfence includes a robust suite of password protection features, all available in the free version of the plugin. Features like Two-Factor Authentication (2FA), blocking logins using known compromised passwords, and preventing brute-force login attempts help safeguard your WordPress users and administrators from unauthorized access.

Brute Force Attacks Blocked
16.0B
+15.3% from previous quarter
Unique IPs in Brute Force
68.1M
+66.4% from previous quarter
Avg Requests Per IP
234
-30.8% from previous quarter

Total Password Attacks Blocked by the Wordfence Firewall Over Q1

The following chart highlights how many password attacks the Wordfence Firewall has blocked over the course of Q1.

Password Attacks Blocked Over Period

Top 10 Countries with the Most Distinctly Unique IP Addresses Engaged in Password Attacks

The following chart highlights countries with the most unique IP addresses originating from them engaged in password attacks.

Top 10 Countries with Distinctly Unique IP Addresses Engaged in Password Attacks

Top 10 Countries with the Highest Volume of Password Attacks Blocked

While the above chart highlights countries with the most unique IP Addresses targeting them. The following chart highlights countries with the most password attack activity based on number of requests, rather than distinctly unique IP Addresses.

Top 10 Countries by Total Password Attacks

Password Attacks Blocked by Type

This section highlights what password attack techniques are the most common.

Password Attacks Blocked by Type

Wordfence Malware Intelligence Report for Q1 2026

This section highlights common trends and patterns in malware attack data across the sites Wordfence protects.

No security solution would be complete without malware detection or scanning. It’s a critical element to website security that if your site gets hacked, it gets detected so that you can take swift remedial action to protect your business and brand reputation.

Did you know? Wordfence’s Malware Signatures are used to provide protection on your site. They are not just used for detecting a compromise, they are also used for blocking uploads of malicious files that match our malware signatures through the Wordfence Firewall.

Malware Attack Data Highlights

Unique Malware Files
27.4M
+100% from previous quarter
Malware Signatures Released
89
+100% from previous quarter
Sites with Malware
474K
+100% from previous quarter
Avg Infected Files Per Site
51.8
-5.8% from previous quarter
Avg Malware Variations Per Site
2.4
-7.7% from previous quarter

Number of Distinct Sites With Malware Detected Over Q1

The following chart highlights the average amount of sites with at least once piece of malware detected over the course of Q1.

Total Number of Distinct Sites With Malware Each Day

Malware Detected by File Type

The following chart highlights the most commonly detected malware based on file type. PHP files are often associated with webshells, backdoors, infostealers, and skimmers while files like JavaScript and HTML are often associated with spam.

Malware Detected by File Type

Malware Detected Based on Uploaded Location

The following chart highlights where malware is most commonly uploaded.

Most Common Directory Malware Detected In

Report Archives for Q1 2026

Access the complete collection of detailed vulnerability and bug bounty reports published during Q1 2026. These archives provide comprehensive documentation of all security issues identified and addressed throughout the quarter.

Weekly Vulnerability Report Archive

In case you missed any of the weekly vulnerability reports from Q1, you can find the complete list of them here:

Monthly Bug Bounty Report Archive

If you missed any of the monthly Bug Bounty Program Reports from Q1, you can find those all here:

Conclusion: Key Takeaways For Site Owners

When it comes to securing your WordPress site, a defense-in-depth strategy is essential. No single solution can stop every attack, but by layering protection, detection, and active monitoring, you dramatically reduce your risk and increase your ability to respond quickly when threats emerge.

Protection

The first line of defense is preventing attacks from succeeding in the first place. A strong firewall, timely vulnerability patches, and hardened configurations help block malicious traffic before it ever reaches your site. By leveraging Wordfence’s threat intelligence, you’re protected against the latest exploits that attackers are actively using in the wild. This proactive protection ensures your site is guarded not just against known threats, but against emerging attack patterns.

Detection

Even the best defenses can be tested, which is why detection is critical. Comprehensive scanning helps identify vulnerabilities, malware, or suspicious changes on your site that could signal an attempted compromise. With Wordfence’s real-time scanning powered by global attack data, you gain visibility into threats that may have slipped past other layers of defense, allowing you to act before they cause serious damage.

Active Monitoring

Continuous monitoring serves as your early warning system. Real-time alerts about critical events, login attempts, and file changes help you stay ahead of threats. Wordfence’s comprehensive monitoring doesn’t just tell you something happened, it provides the context and intelligence you need to understand the severity and respond appropriately. This constant vigilance means you’re never flying blind when it comes to your site’s security posture.

Security isn’t a “set it and forget it” task. Active monitoring ensures your site is continuously observed for suspicious behavior, login attempts, and traffic anomalies. Attackers often probe sites for weaknesses over time; having real-time monitoring means you’ll know immediately if your site is being targeted. Wordfence’s monitoring tools provide alerts and insights so you can take swift action, whether that’s blocking an attacker, tightening access, or responding to a detected vulnerability.

By combining protection, detection, and monitoring, you create a strong defense-in-depth strategy for your WordPress site. Wordfence brings all three layers together in one solution, making it simple to secure your site and stay ahead of attackers. Install Wordfence today and put industry-leading security to work for you.

The post Quarterly WordPress Threat Intelligence Report – Q1 2026 appeared first on Wordfence.

]]> Wordfence Intelligence Weekly WordPress Vulnerability Report (May 25, 2026 to May 31, 2026) https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-may-25-2026-to-may-31-2026/ Thu, 04 Jun 2026 15:38:30 +0000 https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-may-25-2026-to-may-31-2026/ Last week, there were 277 vulnerabilities disclosed in 184 WordPress Plugins and 70 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 94 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 35,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 131
Unpatched 146

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Low Severity 2
Medium Severity 159
High Severity 106
Critical Severity 10

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 77
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 58
Missing Authorization 56
Cross-Site Request Forgery (CSRF) 19
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 16
Deserialization of Untrusted Data 9
Authorization Bypass Through User-Controlled Key 6
Exposure of Sensitive Information to an Unauthorized Actor 6
Improper Privilege Management 5
Improper Control of Generation of Code (‘Code Injection’) 4
Incorrect Privilege Assignment 4
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 3
Unrestricted Upload of File with Dangerous Type 3
Improper Authentication 2
Authentication Bypass by Alternate Name 1
External Control of File Name or Path 1
Improper Restriction of Excessive Authentication Attempts 1
Insufficient Verification of Data Authenticity 1
Missing Authentication for Critical Function 1
Server-Side Request Forgery (SSRF) 1
Uncontrolled Resource Consumption 1
URL Redirection to Untrusted Site (‘Open Redirect’) 1
Weak Password Recovery Mechanism for Forgotten Password 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

35

28

16

10

9

9

9

7

7

7

6

6

6

6

4

4

4

4

4

4

4

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On ar-vr-3d-model-try-on
a3 Lazy Load a3-lazy-load
Accept Stripe Payments stripe-payments
Admin Chat Management admin-chat-box
Adminimize adminimize
Advanced Custom Fields (ACF®) advanced-custom-fields
Advanced Custom Fields: Extended acf-extended
Advanced Custom Fields: Font Awesome Field advanced-custom-fields-font-awesome
Advanced IP Blocker advanced-ip-blocker
Affiliate Super Assistent amazonsimpleadmin
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display affiliate-toolkit-starter
AI Engine – The Chatbot, AI Framework & MCP for WordPress ai-engine
Animate Your Content animate-your-content
Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates animation-addons-for-elementor
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments
Appointment Booking Plugin for WooCommerce – WpBookingly | All-in-One Service Manager service-booking-manager
Auto Affiliate Links wp-auto-affiliate-links
auto making JSON-LD auto-making-json-ld
Auto Thumbnails automatic-thumbnail
Autoship Cloud for WooCommerce Subscription Products autoship-cloud
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More b2bking-wholesale-for-woocommerce
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots bp-better-messages
BitForm – Data management solution for WordPress bitform
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar booking-manager
Breeze Cache breeze
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP videowhisper-live-streaming-integration
CDN Linker lite ossdl-cdn-off-linker
cformsII cforms2
CloudSecure WP Security cloudsecure-wp-security
CM Ad Changer – A simple tool to control and optimize your site’s banners cm-ad-changer
Contact Form 7 – PayPal & Stripe Add-on contact-form-7-paypal-add-on
Content Slideshow content-slideshow
Crawlomatic Multipage Scraper Post Generator crawlomatic-multipage-scraper-post-generator
Cryptocurrency Prijsvergelijking Widget cryptocurrency-prijsvergelijking-widget
DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer 3d-flipbook-dflip-lite
Dideo wp-dideo
Disable Comments & Delete All Comments comments-plus
Duplicate Page and Post duplicate-wp-page-post
E-cab Taxi Booking Manager for Woocommerce ecab-taxi-booking-manager
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy easy-digital-downloads
Easy Form Builder by WhiteStudio — Drag & Drop Form Builder easy-form-builder
Easy Prism Syntax Highlighter easy-prism-syntax-highlighter
Easy Updates Manager stops-core-theme-and-plugin-updates
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor elementskit-lite
Enable jQuery Migrate Helper enable-jquery-migrate-helper
Endless Scroll endless-scroll
EnvíaloSimple: Email Marketing y Newsletters envialosimple-email-marketing-y-newsletters-gratis
Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance accessibility-checker
Event Booking Manager for WooCommerce mage-eventpress
EventPrime – Events Calendar, Bookings and Tickets eventprime-event-calendar-management
Events In City events-in-city
Events Schedule – WordPress Events Calendar Plugin weekly-class
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder everest-forms
Export WordPress Pages to Static HTML & PDF — Static Site Export export-wp-page-to-static-html
faq shortocde faq-shortcode
Favicon by RealFaviconGenerator favicon-by-realfavicongenerator
Feeds for TikTok – Display Video Feeds in Grid Layouts b-tiktok-feed
Felan Framework felan-framework
FlexTable – Data Table Sync with Google Sheets sheets-to-wp-table-live-sync
Formidable Kinetic formidable-kinetic
FOX – Currency Switcher Professional for WooCommerce woocommerce-currency-switcher
Frontend Admin by DynamiApps acf-frontend-form-element
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress gamipress
GBI To Print gbi-to-print
GenerateBlocks generateblocks
Genzel breadcrumbs genzel-breadcrumbs
Geo Mashup geo-mashup
GEO my WP geo-my-wp
Github Shortcode github-shortcode
GNTT Post Title Ticker gntt-post-title-ticker
Google+ Link Name google-plus-name-link-popup-badge
GoStats for WordPress gostats-for-wordpress
GutenBee – Gutenberg Blocks gutenbee
Gutenverse – WordPress Blocks, Page Builder & Site Editor gutenverse
hk_shortcode hk-shortcode
HT Contact Form – Drag & Drop Form Builder for WordPress ht-contactform
Independent Analytics – WordPress Analytics Plugin independent-analytics
Instant-Quote.co Quotation Page iq-quotation-page
Islamic Database islamic-database
iWR Tooltip iwr-tooltip
jQuery googleslides jquery-googleslides
KiviCare – Clinic & Patient Management System (EHR) kivicare-clinic-management-system
Link Whisper Free link-whisper
Listen Shortcode listen-shortcode
LiteSpeed Cache litespeed-cache
Livemesh Addons for Beaver Builder addons-for-beaver-builder
Livemesh SiteOrigin Widgets livemesh-siteorigin-widgets
LiveSmart Video Chat Live Video Chat new-dev-livesmart-video-chat
Login No Captcha reCAPTCHA login-recaptcha
Login with NEAR near-login
Login with OTP otp-login
Master Slider – Responsive Touch Slider master-slider
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates learning-management-system
Mayosis Core mayosis-core
Media Library Assistant media-library-assistant
Meta Field Block – Display custom fields in the Block Editor without coding display-a-meta-field-as-block
Meta for WooCommerce facebook-for-woocommerce
MetaMagic SEO Plugin metamagic
MinhNhut Link Gateway minhnhut-link-gateway
Modula Image Gallery – Photo Grid & Video Gallery modula-best-grid-gallery
Mutual Funds Data mutual-funds-data
My Email Shortcode my-email-shortcode
myLinksDump mylinksdump
Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend views-for-ninja-forms
NS Product icon badge product-icon-badge
Old Posts Highlighter old-posts-highlighter
Organization chart organization-chart
OTP Login With Phone Number, OTP Verification login-with-phone-number
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams ppv-live-webcams
PDF Embedder pdf-embedder
PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) peachpay-for-woocommerce
Photo Gallery by 10Web – Mobile-Friendly Image Gallery photo-gallery
Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls poll-maker
Post Categories Gallery post-category-gallery
Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App post-smtp
Post Snippets – Custom WordPress Code Snippets Customizer post-snippets
Product Import Export for WooCommerce – Import Export Product CSV Suite product-import-export-for-woo
QR Redirector qr-redirector
Quads Ads Manager for Google AdSense quick-adsense-reloaded
Query Shortcode query-shortcode
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings seo-by-rank-math
Realtyna Organic IDX plugin + WPL Real Estate real-estate-listing-realtyna-wpl
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress computer-repair-shop
Responsive Check responsive-checker-real-time
Responsive Video Embedder responsive-video-embedder
rexCrawler rexcrawler
RSVP and Event Management rsvp
Search Analytics for WP search-analytics
Search Simple Fields search-simple-fields
SeedProd Pro seedprod-coming-soon-pro-5
SePay Gateway sepay-gateway
Shariff Wrapper shariff
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin woolentor-addons
Shortcode Buddy shortcode-buddy
Simple Divi Shortcode simple-divi-shortcode
Simple History – Track, Log, and Audit WordPress Changes simple-history
Single Mailchimp single-mailchimp
SlimStat Analytics wp-slimstat
Smart Online Order for Clover clover-online-orders
SMTP2GO for WordPress – Email Made Easy smtp2go
Spectra Gutenberg Blocks – Website Builder for the Block Editor ultimate-addons-for-gutenberg
Splide Carousel Block splide-carousel
StatCounter – Free Real Time Visitor Stats official-statcounter-plugin-for-wordpress
Style Kits for Elementor analogwp-templates
Subscription & Recurring Payment for WooCommerce subscription
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers sunshine-photo-cart
Support Ticket Management System for WordPress support_ticket
SVG Support svg-support
sw_core sw_core
Sweet Date Core sweetdate-core
TableOn – WordPress Posts Table Filterable  posts-table-filterable
Tainacan tainacan
Team Master – A Modern WordPress Team Showcase team-master
Team Showcase team
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce the-plus-addons-for-elementor-page-builder
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid the-post-grid
Timetable and Event Schedule by MotoPress mp-timetable
Travelly – Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Solution tour-booking-manager
Tuxquote tuxquote
Two-factor authentication (formerly IP Vault) ip-vault-wp-firewall
Unlimited Elements For Elementor unlimited-elements-for-elementor
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder user-registration
Views for WPForms – Display & Edit WPForms Entries on your site frontend views-for-wpforms-lite
VikBooking Hotel Booking Engine & PMS vikbooking
Visualizer: Tables and Charts Manager for WordPress visualizer
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace wc-multivendor-membership
WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce webinar-ignition
Woocommerce Envato Affiliates wooenvato
WooCommerce Infinite Scroll and Ajax Pagination sb-woocommerce-infinite-scrol
WP AutoBuzz wp-autobuzz
WP Contact Form 7 DB Handler wp-contact-form-7-db-handler
WP Iframe Geo Style for Amazon affiliates wp-iframe-geo-style-for-amazon-affiliates
WP Maps Pro wp-google-map-gold
WP Meta and Date Remover wp-meta-and-date-remover
WP Promoter wp-promoter
WP Travel Pro wp-travel-pro
WPBakery Page Builder Addons by Livemesh addons-for-visual-composer
WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager insert-headers-and-footers
WPComplete wpcomplete
WPCS – WordPress Currency Switcher Professional currency-switcher
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More wpforms-lite
WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce wpify-woo
Xpro Elementor Addons – Pro xpro-elementor-addons-pro
Yoast SEO – Advanced SEO with real-time guidance and built-in AI wordpress-seo

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Abelle abelle
AirSupply | Conditioning Company and Heating Services WordPress Theme + RTL air-supply
Automotive Car Dealership Business WordPress Theme automotive
Brikk – Directory & Listing WordPress Theme brikk
CarZone – A Complete Car Dealer HTML Wire-Frame carzone
Choreo choreo
Confidant – Startup & Consulting Services WordPress Theme confidant
CopyPress copypress
Corbesier corbesier
Crafti – Handmade Store WordPress Theme crafti
Dazzle – Manufacturing & Factory Elementor Pro template Kit dazzle
Deliciosa deliciosa
Dom dom
Entrepreneur – Booking for Small Businesses WordPress Theme entrepreneurx
Eros eros
Especio – Food Blog Elementor Pro Template Kit especio
Etude – Design Agency & Branding Agency WordPress Theme etude
Eventicity eventicity
Fermentio — Brewery and Winemaking Restaurant WordPress Theme fermentio
Food Drop | Meal Ordering & Delivery Mobile App WordPress Theme food-drop
Fortius fortius
Gamic – Gaming Metaverse Game & Crypto WordPress Theme gamic
Gat gat
Genemy – Creative Minimal Landing Page Builder for Digital Startup Design Studio Agency in Marketing genemy
Geya – Renewable Energy & Ecology WordPress Theme geya
Gita gita
Grand Car Rental | Limousine HTML Template grandcarrental
Granola – SEO & Marketing Agency WordPress Theme granola
Grecko | Business WordPress Theme grecko
Gunslinger gunslinger
Home Health Care, Medical Care WordPress Theme – NanoCare nanocare
Hot Coffee | Coffee Shop & Cafe WordPress Theme hot-coffee
Imba imba
Ingenioso ingenioso
Iona – Handmade & Crafts Shop WordPress Theme iona
ITactics – IT Solutions & Digital Startup WordPress Theme + AI itactics
JobCareer jobcareer
Kelly Young kelly-young
Line Agency | Interior Design & Architecture WordPress Theme lineagency
LuxMed | Medicine & Healthcare Doctor WordPress Theme luxmed
MaxiNet – Internet & IPTV Provider Elementor Template Kit maxinet
Medeus medeus
Mission mission
Modernee modernee
Newses newses
Nexio nexio
Nyla – A Fresh & Modern WooCommerce Theme nyla
Orpheus orpheus
Planty planty
Plumbing – Plumber and Handyman WordPress Theme plumbing-parts
Preservation preservation
Printo printo
Putter putter
Qreatix – Interactive Portfolio WordPress Theme qreatix
quirky quirky
Reisen | Auto Store & Car Repair WordPress Theme reisen
Resurs – Physiotherapy & Psychology Rehabilitation WordPress Theme resurs
Roneous – Creative Multi-Purpose WordPress Theme roneous
Rosaleen rosaleen
SeaFood Company – Fish Restaurant WordPress Theme seafood-company
Skyward skyward
Snow Club | Ski Resort and Snowboard Classes WordPress Theme snow-club
snowy snowy
Spike – Volleyball Sports WordPress Theme spike
Spin – Cricket Team Sports WordPress Theme + AI spin
tipsy tipsy
Top Dog top-dog
Truemag truemag
Wanium – A Elegant Multi-Concept Theme wanium
WineShop – Food & Wine Store WordPress Theme wineshop

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Advanced Custom Fields: Extended <= 0.9.2.5 – Unauthenticated Privilege Escalation via Validation Bypass to ‘_acf_post_id’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-8809
Patch Status
Patched
Published
May 28, 2026

Affected Software

Advanced Custom Fields: Extended [acf-extended]

Researcher

More Details >

Login with OTP <= 1.6 – Unauthenticated Authentication Bypass via OTP Brute Force

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-8760
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Login with OTP [otp-login]

Researcher

More Details >

OTP Login With Phone Number, OTP Verification <= 1.8.60 – Unauthenticated Authentication Bypass via Firebase OTP Verification

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-3655
Patch Status
Patched
Published
May 28, 2026

Affected Software

OTP Login With Phone Number, OTP Verification [login-with-phone-number]

Researcher

More Details >

Support Ticket Management System <= 1.9 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2025-69179
Patch Status
Unpatched
Published
May 28, 2026

Affected Software

Support Ticket Management System for WordPress [support_ticket]

Researcher

More Details >

WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce < 4.08.253 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-42758
Patch Status
Patched
Published
May 30, 2026

Affected Software

WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce [webinar-ignition]

Researcher

More Details >

WP Maps Pro <= 6.1.0 – Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-8732
Patch Status
Patched
Published
May 28, 2026

Affected Software

WP Maps Pro [wp-google-map-gold]

Researcher

More Details >

CarZone – A Complete Car Dealer HTML Wire-Frame <= 3.7 – Unauthenticated Arbitrary File Deletion

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2025-69139
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

CarZone – A Complete Car Dealer HTML Wire-Frame [carzone]

Researcher

More Details >

GEO my WP <= 4.5.4 – Unauthenticated SQL Injection via ‘distance’ / ‘lat’ / ‘lng’ Parameters

9.1

CVSS Rating
9.1 (Critical)
Patch Status
Patched
Published
May 27, 2026

Affected Software

GEO my WP [geo-my-wp]

Researcher(s): Unknown

More Details >

VikBooking Hotel Booking Engine & PMS <= 1.8.10 – Unauthenticated Arbitrary File Deletion

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-42737
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

VikBooking Hotel Booking Engine & PMS [vikbooking]

Researcher

More Details >

WP Travel Pro <= 10.6.0 – Missing Authorization to Unauthenticated Arbitrary User Deletion Including Administrators

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-4290
Patch Status
Unpatched
Published
May 28, 2026

Affected Software

WP Travel Pro [wp-travel-pro]

Researcher

More Details >

Crawlomatic Multipage Scraper Post Generator <= 2.7.2 – Authenticated (Author+) Remote Code Execution via ‘callback_raw’ Shortcode Attribute

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-9009
Patch Status
Patched
Published
May 27, 2026

Affected Software

Crawlomatic Multipage Scraper Post Generator [crawlomatic-multipage-scraper-post-generator]

Researcher

More Details >

Firebase Support & Chat Management <= 3.1.1 – Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-8787
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Admin Chat Management [admin-chat-box]

Researcher

More Details >

Frontend Admin by DynamiApps <= 3.29.2 – Missing Authorization to Authenticated (Subscriber+) Account Takeover via ‘user_id’ URL Query Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-7802
Patch Status
Patched
Published
May 27, 2026

Affected Software

Frontend Admin by DynamiApps [acf-frontend-form-element]

Researcher

More Details >

Frontend Admin by DynamiApps <= 3.29.2 – Unauthenticated Privilege Escalation via Form Configuration Injection

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-6226
Patch Status
Patched
Published
May 27, 2026

Affected Software

Frontend Admin by DynamiApps [acf-frontend-form-element]

Researcher

More Details >

Genemy – Creative Minimal Landing Page Builder for Digital Startup Design Studio Agency in Marketing <= 1.6.6 – Authenticated (Subscriber+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2025-69138
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Genemy – Creative Minimal Landing Page Builder for Digital Startup Design Studio Agency in Marketing [genemy]

Researcher

More Details >

GutenBee <= 2.20.1 – Authenticated (Author+) Arbitrary File Upload via wp_check_filetype_and_ext Filter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-9227
Patch Status
Patched
Published
May 27, 2026

Affected Software

GutenBee – Gutenberg Blocks [gutenbee]

Researcher

More Details >

Spectra Gutenberg Blocks <= 2.19.25 – Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-7465
Patch Status
Patched
Published
May 29, 2026

Affected Software

Spectra Gutenberg Blocks – Website Builder for the Block Editor [ultimate-addons-for-gutenberg]

Researcher

More Details >

WooCommerce Infinite Scroll and Ajax Pagination <= 1.8 – Authenticated (Subscriber+) PHP Object Injection

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2025-11993
Patch Status
Unpatched
Published
May 28, 2026

Affected Software

WooCommerce Infinite Scroll and Ajax Pagination [sb-woocommerce-infinite-scrol]

Researcher

More Details >

WPCode <= 2.3.5 – Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-8832
Patch Status
Patched
Published
May 26, 2026

Affected Software

WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager [insert-headers-and-footers]

Researcher

More Details >

WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce <= 5.4.1 – Authenticated (Contributor+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-42748
Patch Status
Patched
Published
May 29, 2026

Affected Software

WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce [wpify-woo]

Researcher

More Details >

Abelle <= 1.22 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69142
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Abelle [abelle]

Researcher

More Details >

AirSupply <= 2.0.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69110
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

AirSupply | Conditioning Company and Heating Services WordPress Theme + RTL [air-supply]

Researcher

More Details >

Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP < 7.1.3 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-27053
Patch Status
Patched
Published
May 28, 2026

Affected Software

Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP [videowhisper-live-streaming-integration]

Researcher

More Details >

Choreo <= 1.6 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69165
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

Choreo [choreo]

Researcher

More Details >

Confidant – Startup & Consulting Services WordPress Theme <= 1.4 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-53440
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Confidant – Startup & Consulting Services WordPress Theme [confidant]

Researcher

More Details >

CopyPress <= 1.4.5 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69118
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

CopyPress [copypress]

Researcher

More Details >

Corbesier <= 1.15.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69119
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Corbesier [corbesier]

Researcher

More Details >

Crafti – Handmade Store WordPress Theme <= 1.12 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-58705
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Crafti – Handmade Store WordPress Theme [crafti]

Researcher

More Details >

Dazzle <= 1.0.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69120
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Dazzle – Manufacturing & Factory Elementor Pro template Kit [dazzle]

Researcher

More Details >

Deliciosa <= 1.10.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69121
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Deliciosa [deliciosa]

Researcher

More Details >

Dom <= 1.24 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69146
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Dom [dom]

Researcher

More Details >

Eros <= 1.3 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69167
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

Eros [eros]

Researcher

More Details >

Especio – Food Blog Elementor Pro Template Kit <= 1.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69124
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Especio – Food Blog Elementor Pro Template Kit [especio]

Researcher

More Details >

Etude <= 1.6 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69174
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

Etude – Design Agency & Branding Agency WordPress Theme [etude]

Researcher

More Details >

Eventicity <= 1.5 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69170
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

Eventicity [eventicity]

Researcher

More Details >

EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-42687
Patch Status
Patched
Published
May 25, 2026

Affected Software

EventPrime – Events Calendar, Bookings and Tickets [eventprime-event-calendar-management]

Researcher

More Details >

Fermentio — Brewery and Winemaking Restaurant WordPress Theme <= 1.5.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-58897
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Fermentio — Brewery and Winemaking Restaurant WordPress Theme [fermentio]

Researcher

More Details >

Food Drop <= 1.3 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69125
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Food Drop | Meal Ordering & Delivery Mobile App WordPress Theme [food-drop]

Researcher

More Details >

Fortius <= 2.3.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69126
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Fortius [fortius]

Researcher

More Details >

Gamic <= 1.15 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69157
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

Gamic – Gaming Metaverse Game & Crypto WordPress Theme [gamic]

Researcher

More Details >

Gat <= 1.16 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69145
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Gat [gat]

Researcher

More Details >

Geya – Renewable Energy & Ecology WordPress Theme <= 1.15 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-58924
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Geya – Renewable Energy & Ecology WordPress Theme [geya]

Researcher

More Details >

Gita <= 1.11 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69160
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

Gita [gita]

Researcher

More Details >

Granola <= 1.13 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69158
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

Granola – SEO & Marketing Agency WordPress Theme [granola]

Researcher

More Details >

Grecko <= 5.17 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69162
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

Grecko | Business WordPress Theme [grecko]

Researcher

More Details >

Gunslinger <= 1.7 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69166
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

Gunslinger [gunslinger]

Researcher

More Details >

Hot Coffee <= 1.7 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69108
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Hot Coffee | Coffee Shop & Cafe WordPress Theme [hot-coffee]

Researcher

More Details >

Imba <= 1.5.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69106
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Imba [imba]

Researcher

More Details >

Ingenioso <= 1.14.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69117
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Ingenioso [ingenioso]

Researcher

More Details >

Iona <= 1.0.8 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69116
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Iona – Handmade & Crafts Shop WordPress Theme [iona]

Researcher

More Details >

ITactics <= 1.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69176
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

ITactics – IT Solutions & Digital Startup WordPress Theme + AI [itactics]

Researcher

More Details >

Kelly Young <= 1.1.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69141
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Kelly Young [kelly-young]

Researcher

More Details >

Line Agency <= 1.3.1 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69175
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

Line Agency | Interior Design & Architecture WordPress Theme [lineagency]

Researcher

More Details >

Login with NEAR <= 0.3.3 – Authentication Bypass via ‘account’ Parameter

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-8994
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Login with NEAR [near-login]

Researcher

More Details >

LuxMed | Medicine & Healthcare Doctor WordPress <= 1.2.2 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69115
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

LuxMed | Medicine & Healthcare Doctor WordPress Theme [luxmed]

Researcher

More Details >

MaxiNet – Internet & IPTV Provider Elementor Template Kit <= 1.2.10 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69114
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

MaxiNet – Internet & IPTV Provider Elementor Template Kit [maxinet]

Researcher

More Details >

Medeus <= 1.14 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69150
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Medeus [medeus]

Researcher

More Details >

Media Library Assistant <= 3.35 – Cross-Site Request Forgery via Bulk Action Form

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-6075
Patch Status
Patched
Published
May 28, 2026

Affected Software

Media Library Assistant [media-library-assistant]

Researcher

More Details >

Mission <= 1.22 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69143
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Mission [mission]

Researcher

More Details >

Modernee <= 1.6.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69105
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Modernee [modernee]

Researcher

More Details >

Nexio <= 1.10.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69113
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Nexio [nexio]

Researcher

More Details >

Orpheus <= 1.3 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69171
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

Orpheus [orpheus]

Researcher

More Details >

Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.3.23 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-27333
Patch Status
Patched
Published
May 28, 2026

Affected Software

Paid Videochat Turnkey Site – HTML5 PPV Live Webcams [ppv-live-webcams]

Researcher

More Details >

Planty <= 1.14.0 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69112
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Planty [planty]

Researcher

More Details >

Plumbing <= 1.6 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69127
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Plumbing – Plumber and Handyman WordPress Theme [plumbing-parts]

Researcher

More Details >

Preservation <= 1.10 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69144
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Preservation [preservation]

Researcher

More Details >

Printo <= 1.11 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69159
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

Printo [printo]

Researcher

More Details >

Putter <= 1.17 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69147
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Putter [putter]

Researcher

More Details >

Quirky <= 1.23 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69148
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

quirky [quirky]

Researcher

More Details >

Reisen <= 1.4.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69111
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Reisen | Auto Store & Car Repair WordPress Theme [reisen]

Researcher

More Details >

Resurs <= 1.3 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69172
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

Resurs – Physiotherapy & Psychology Rehabilitation WordPress Theme [resurs]

Researcher

More Details >

Roneous – Creative Multi-Purpose WordPress Theme <= 2.1.5 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69177
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

Roneous – Creative Multi-Purpose WordPress Theme [roneous]

Researcher

More Details >

Rosaleen <= 2.8 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69107
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Rosaleen [rosaleen]

Researcher

More Details >

SeaFood Company <= 1.4 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69122
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

SeaFood Company – Fish Restaurant WordPress Theme [seafood-company]

Researcher

More Details >

Skyward <= 1.10 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69164
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

Skyward [skyward]

Researcher

More Details >

Snow Club <= 1.1 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69123
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Snow Club | Ski Resort and Snowboard Classes WordPress Theme [snow-club]

Researcher

More Details >

Snowy <= 1.13 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69161
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

snowy [snowy]

Researcher

More Details >

Spike <= 1.2 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69168
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

Spike – Volleyball Sports WordPress Theme [spike]

Researcher

More Details >

Spin – Cricket Team Sports WordPress Theme + AI <= 1.8 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-58707
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Spin – Cricket Team Sports WordPress Theme + AI [spin]

Researcher

More Details >

Tipsy <= 1.1 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69173
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

tipsy [tipsy]

Researcher

More Details >

Top Dog <= 1.0.5 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69149
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Top Dog [top-dog]

Researcher

More Details >

Truemag <= 4.3.14.2 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69178
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

Truemag [truemag]

Researcher

More Details >

Wanium <= 1.9.8 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69136
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Wanium – A Elegant Multi-Concept Theme [wanium]

Researcher

More Details >

WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce < 4.08.253 – Authenticated (Subscriber+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-42757
Patch Status
Patched
Published
May 30, 2026

Affected Software

WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce [webinar-ignition]

Researcher

More Details >

WineShop – Food & Wine Store WordPress Theme <= 3.17 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2025-69163
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

WineShop – Food & Wine Store WordPress Theme [wineshop]

Researcher

More Details >

WP Contact Form 7 DB Handler <= 3.0 – Cross-Site Request Forgery to Arbitrary File Deletion via ‘contact_form’ Parameter

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-6455
Patch Status
Patched
Published
May 27, 2026

Affected Software

WP Contact Form 7 DB Handler [wp-contact-form-7-db-handler]

Researchers

More Details >

Appointment Booking Calendar <= 1.6.11.8 – Unauthenticated SQL Injection via ‘append_where_sql’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-7797
Patch Status
Patched
Published
May 27, 2026

Affected Software

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin [simply-schedule-appointments]

Researcher

More Details >

Easy Form Builder by WhiteStudio — Drag & Drop Form Builder <= 4.0.6 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-42747
Patch Status
Patched
Published
May 28, 2026

Affected Software

Easy Form Builder by WhiteStudio — Drag & Drop Form Builder [easy-form-builder]

Researcher

More Details >

Entrepreneur – Booking for Small Businesses WordPress <= 3.1.3 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2025-69130
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Entrepreneur – Booking for Small Businesses WordPress Theme [entrepreneurx]

Researcher

More Details >

GEO my WP <= 4.5.4 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
Patch Status
Patched
Published
May 28, 2026

Affected Software

GEO my WP [geo-my-wp]

Researcher(s): Unknown

More Details >

GEO my WP <= 4.5.5 – Unauthenticated SQL Injection via ‘swlatlng’ / ‘nelatlng’ Parameters

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-9757
Patch Status
Patched
Published
May 29, 2026

Affected Software

GEO my WP [geo-my-wp]

Researcher

More Details >

Query Shortcode <= 0.2.1 – Authenticated (Contributor+) Local File Inclusion via ‘lens’ Shortcode Attribute

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-9200
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Query Shortcode [query-shortcode]

Researcher

More Details >

Realtyna Organic IDX plugin + WPL Real Estate <= 5.1.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-45439
Patch Status
Patched
Published
May 26, 2026

Affected Software

Realtyna Organic IDX plugin + WPL Real Estate [real-estate-listing-realtyna-wpl]

Researcher

More Details >

SeedProd Pro < 6.19.5 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-48972
Patch Status
Patched
Published
May 27, 2026

Affected Software

SeedProd Pro [seedprod-coming-soon-pro-5]

Researcher

More Details >

Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 – Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-7459
Patch Status
Patched
Published
May 29, 2026

Affected Software

Simple History – Track, Log, and Audit WordPress Changes [simple-history]

Researcher

More Details >

SW Core <= 1.7.18 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-39661
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

sw_core [sw_core]

Researcher

More Details >

TableOn – WordPress Posts Table Filterable  <= 1.0.5.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-42755
Patch Status
Patched
Published
May 30, 2026

Affected Software

TableOn – WordPress Posts Table Filterable  [posts-table-filterable]

Researcher

More Details >

Tainacan <= 1.0.3 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-42740
Patch Status
Patched
Published
May 28, 2026

Affected Software

Tainacan [tainacan]

Researcher

More Details >

Advanced IP Blocker <= 8.10.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42739
Patch Status
Patched
Published
May 28, 2026

Affected Software

Advanced IP Blocker [advanced-ip-blocker]

Researcher

More Details >

Affiliate Super Assistent <= 1.10.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42759
Patch Status
Patched
Published
May 30, 2026

Affected Software

Affiliate Super Assistent [amazonsimpleadmin]

Researcher

More Details >

affiliate-toolkit <= 3.8.5 – Authenticated (Editor+) Remote Code Execution

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-6169
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display [affiliate-toolkit-starter]

Researcher

More Details >

AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.4.9 – Authenticated (Editor+) Privilege Escalation

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-27407
Patch Status
Patched
Published
May 28, 2026

Affected Software

AI Engine – The Chatbot, AI Framework & MCP for WordPress [ai-engine]

Researcher

More Details >

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.10.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-39447
Patch Status
Patched
Published
May 28, 2026

Affected Software

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin [simply-schedule-appointments]

Researcher

More Details >

Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP < 7.1.3 – Authenticated (Admin+) Remote Code Execution

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-24937
Patch Status
Patched
Published
May 25, 2026

Affected Software

Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP [videowhisper-live-streaming-integration]

Researcher

More Details >

Favicon by RealFaviconGenerator <= 1.3.46 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42754
Patch Status
Patched
Published
May 30, 2026

Affected Software

Favicon by RealFaviconGenerator [favicon-by-realfavicongenerator]

Researcher

More Details >

Geo Mashup <= 1.13.19 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42734
Patch Status
Patched
Published
May 26, 2026

Affected Software

Geo Mashup [geo-mashup]

Researcher

More Details >

Grand Car Rental | Limousine HTML Template <= 3.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2025-69151
Patch Status
Unpatched
Published
May 28, 2026

Affected Software

Grand Car Rental | Limousine HTML Template [grandcarrental]

Researcher

More Details >

HT Contact Form <= 2.8.2 – Unauthenticated Stored Cross-Site Scripting via File Upload Field

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-7052
Patch Status
Patched
Published
May 27, 2026

Affected Software

HT Contact Form – Drag & Drop Form Builder for WordPress [ht-contactform]

Researcher

More Details >

Link Whisper Free <= 0.9.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2025-11262
Patch Status
Patched
Published
May 28, 2026

Affected Software

Link Whisper Free [link-whisper]

Researcher

More Details >

LiteSpeed Cache <= 7.7 – Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-3375
Patch Status
Patched
Published
May 26, 2026

Affected Software

LiteSpeed Cache [litespeed-cache]

Researcher

More Details >

Login No Captcha reCAPTCHA <= 1.8.0 – Unauthenticated Stored Cross-Site Scripting via PHP_SELF

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-2374
Patch Status
Patched
Published
May 27, 2026

Affected Software

Login No Captcha reCAPTCHA [login-recaptcha]

Researcher

More Details >

Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App <= 3.6.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-48838
Patch Status
Patched
Published
May 28, 2026

Affected Software

Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App [post-smtp]

Researcher

More Details >

Qreatix <= 1.9.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2025-69104
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Qreatix – Interactive Portfolio WordPress Theme [qreatix]

Researcher

More Details >

SlimStat Analytics <= 5.4.11 – Unauthenticated Stored Cross-Site Scripting via User-Agent Header

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-7634
Patch Status
Patched
Published
May 27, 2026

Affected Software

SlimStat Analytics [wp-slimstat]

Researcher

More Details >

Smart Online Order for Clover <= 1.6.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42738
Patch Status
Patched
Published
May 27, 2026

Affected Software

Smart Online Order for Clover [clover-online-orders]

Researcher

More Details >

WPCS – WordPress Currency Switcher Professional <= 1.3.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-42733
Patch Status
Patched
Published
May 25, 2026

Affected Software

WPCS – WordPress Currency Switcher Professional [currency-switcher]

Researcher

More Details >

Duplicate Page and Post <= 2.9.5 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-49046
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

Duplicate Page and Post [duplicate-wp-page-post]

Researcher

More Details >

Enable jQuery Migrate Helper <= 1.4.1 – Missing Authorization to Authenticated (Subscriber+) jQuery Version Downgrade

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-3279
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Enable jQuery Migrate Helper [enable-jquery-migrate-helper]

Researcher

More Details >

Events Schedule – WordPress Events Calendar <= 2.7.2 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2025-69135
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Events Schedule – WordPress Events Calendar Plugin [weekly-class]

Researcher

More Details >

Independent Analytics <= 2.14.9 – Unauthenticated Server-Side Request Forgery via Tracking Route

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-5737
Patch Status
Patched
Published
May 27, 2026

Affected Software

Independent Analytics – WordPress Analytics Plugin [independent-analytics]

Researcher

More Details >

Meta Field Block <= 1.5.1 – Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary User Meta Exposure

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-3173
Patch Status
Patched
Published
May 27, 2026

Affected Software

Meta Field Block – Display custom fields in the Block Editor without coding [display-a-meta-field-as-block]

Researcher

More Details >

Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend <= 3.3.2 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-42741
Patch Status
Patched
Published
May 28, 2026

Affected Software

Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend [views-for-ninja-forms]

Researcher

More Details >

Nyla <= 1.7 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-39642
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Nyla – A Fresh & Modern WooCommerce Theme [nyla]

Researcher

More Details >

Photo Gallery by 10Web <= 1.8.40 – Authenticated (Contributor+) SQL Injection via ‘order_by’ Shortcode Attribute

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-7048
Patch Status
Patched
Published
May 27, 2026

Affected Software

Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]

Researcher

More Details >

Unlimited Elements For Elementor <= 2.0.8 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-48837
Patch Status
Patched
Published
May 26, 2026

Affected Software

Unlimited Elements For Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

Views for WPForms – Display & Edit WPForms Entries on your site frontend <= 3.4.6 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-42742
Patch Status
Patched
Published
May 28, 2026

Affected Software

Views for WPForms – Display & Edit WPForms Entries on your site frontend [views-for-wpforms-lite]

Researcher

More Details >

Xpro Elementor Addons – Pro <= 1.4.7 – Authenticated (Contributor+) Arbitrary File Read via Draw SVG

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2025-0898
Patch Status
Patched
Published
May 26, 2026

Affected Software

Xpro Elementor Addons – Pro [xpro-elementor-addons-pro]

Researcher

More Details >

a3 Lazy Load <= 2.7.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via Video Element

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-6427
Patch Status
Patched
Published
May 27, 2026

Affected Software

a3 Lazy Load [a3-lazy-load]

Researcher

More Details >

Advanced Custom Fields: Font Awesome Field <= 5.0.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-49044
Patch Status
Patched
Published
May 27, 2026

Affected Software

Advanced Custom Fields: Font Awesome Field [advanced-custom-fields-font-awesome]

Researcher

More Details >

Animate Your Content <= 1.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8872
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Animate Your Content [animate-your-content]

Researcher

More Details >

Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates <= 2.6.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
Patch Status
Patched
Published
May 26, 2026

Affected Software

Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates [animation-addons-for-elementor]

Researcher

More Details >

Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates <= 2.6.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
Patch Status
Patched
Published
May 26, 2026

Affected Software

Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates [animation-addons-for-elementor]

Researcher

More Details >

Animation Addons for Elementor <= 2.6.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget

6.4

CVSS Rating
6.4 (Medium)
Patch Status
Patched
Published
May 26, 2026

Affected Software

Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates [animation-addons-for-elementor]

Researcher

More Details >

Auto Thumbnails <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8899
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Auto Thumbnails [automatic-thumbnail]

Researcher

More Details >

Automotive Car Dealership Business WordPress Theme <= 13.4.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Portfolio Project Details

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2025-14042
Patch Status
Patched
Published
May 28, 2026

Affected Software

Automotive Car Dealership Business WordPress Theme [automotive]

Researcher

More Details >

BitForm <= 1.1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8891
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

BitForm – Data management solution for WordPress [bitform]

Researcher

More Details >

Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar <= 2.1.18 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-42751
Patch Status
Patched
Published
May 29, 2026

Affected Software

Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar [booking-manager]

Researcher

More Details >

Content Slideshow <= 2.4.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8873
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Content Slideshow [content-slideshow]

Researcher

More Details >

Cryptocurrency Prijsvergelijking Widget <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘width’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8698
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Cryptocurrency Prijsvergelijking Widget [cryptocurrency-prijsvergelijking-widget]

Researcher

More Details >

Dideo <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8847
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Dideo [wp-dideo]

Researcher

More Details >

Easy Prism Syntax Highlighter <= 1.0.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8875
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Easy Prism Syntax Highlighter [easy-prism-syntax-highlighter]

Researcher

More Details >

Endless Scroll <= 1.0.0 – [Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)]

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8703
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Endless Scroll [endless-scroll]

Researcher

More Details >

Events In City <= 3.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8898
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Events In City [events-in-city]

Researcher

More Details >

faq shortocde <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘color’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8040
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

faq shortocde [faq-shortcode]

Researcher

More Details >

Formidable Kinetic <= 1.1.01 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8871
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Formidable Kinetic [formidable-kinetic]

Researcher

More Details >

GBI To Print <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘div’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8702
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

GBI To Print [gbi-to-print]

Researcher

More Details >

Geo Mashup <= 1.13.18 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-27427
Patch Status
Patched
Published
May 26, 2026

Affected Software

Geo Mashup [geo-mashup]

Researcher

More Details >

Github Shortcode <= 0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8042
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Github Shortcode [github-shortcode]

Researcher

More Details >

GNTT Post Title Ticker <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8701
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

GNTT Post Title Ticker [gntt-post-title-ticker]

Researcher

More Details >

Google+ Link Name <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8842
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Google+ Link Name [google-plus-name-link-popup-badge]

Researcher

More Details >

hk_shortcode <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘title’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8886
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

hk_shortcode [hk-shortcode]

Researcher

More Details >

Instant-Quote.co Quotation Page <= 1.3.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8884
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Instant-Quote.co Quotation Page [iq-quotation-page]

Researcher

More Details >

Islamic Database <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8845
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Islamic Database [islamic-database]

Researcher

More Details >

iWR Tooltip <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8894
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

iWR Tooltip [iwr-tooltip]

Researcher

More Details >

jQuery googleslides <= 1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8866
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

jQuery googleslides [jquery-googleslides]

Researcher

More Details >

Listen Shortcode <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8887
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Listen Shortcode [listen-shortcode]

Researcher

More Details >

Livemesh Addons for Beaver Builder <= 3.9.2 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Missing Authorization

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-3897
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Livemesh Addons for Beaver Builder [addons-for-beaver-builder]

Researcher

More Details >

Livemesh SiteOrigin Widgets <= 3.9.2 – Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-3896
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Livemesh SiteOrigin Widgets [livemesh-siteorigin-widgets]

Researcher

More Details >

LiveSmart Video Chat <= 1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-9644
Patch Status
Patched
Published
May 27, 2026

Affected Software

LiveSmart Video Chat Live Video Chat [new-dev-livesmart-video-chat]

Researcher

More Details >

Master Slider – Responsive Touch Slider <= 3.10.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-48968
Patch Status
Patched
Published
May 27, 2026

Affected Software

Master Slider – Responsive Touch Slider [master-slider]

Researcher

More Details >

Modula Image Gallery – Photo Grid & Video Gallery <= 2.14.23 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-42688
Patch Status
Patched
Published
May 26, 2026

Affected Software

Modula Image Gallery – Photo Grid & Video Gallery [modula-best-grid-gallery]

Researcher

More Details >

Mutual Funds Data <= 1.2.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘title’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8869
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Mutual Funds Data [mutual-funds-data]

Researcher

More Details >

My Email Shortcode <= 0.91 – [Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)]

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8048
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

My Email Shortcode [my-email-shortcode]

Researcher

More Details >

Post Categories Gallery <= 1.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8867
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Post Categories Gallery [post-category-gallery]

Researcher

More Details >

Responsive Check <= 0.0.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8844
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Responsive Check [responsive-checker-real-time]

Researcher

More Details >

Responsive Video Embedder <= 0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8877
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Responsive Video Embedder [responsive-video-embedder]

Researcher

More Details >

Shariff Wrapper <= 4.6.20 – Authenticated (Contributor+) Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-4334
Patch Status
Patched
Published
May 27, 2026

Affected Software

Shariff Wrapper [shariff]

Researcher

More Details >

Shortcode Buddy <= 0.1.9.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8897
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Shortcode Buddy [shortcode-buddy]

Researcher

More Details >

Simple Divi Shortcode <= 1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘id’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-9714
Patch Status
Patched
Published
May 28, 2026

Affected Software

Simple Divi Shortcode [simple-divi-shortcode]

Researcher

More Details >

Single Mailchimp <= 1.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8868
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Single Mailchimp [single-mailchimp]

Researcher

More Details >

Splide Carousel Block <= 1.7.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘url’ Block Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-9022
Patch Status
Patched
Published
May 26, 2026

Affected Software

Splide Carousel Block [splide-carousel]

Researcher

More Details >

StatCounter <= 2.1.1 – Authenticated (Author+) Stored Cross-Site Scripting via Author Nickname

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-6275
Patch Status
Patched
Published
May 28, 2026

Affected Software

StatCounter – Free Real Time Visitor Stats [official-statcounter-plugin-for-wordpress]

Researcher

More Details >

Style Kits – Advanced Theme Styles for Elementor <= 2.5.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Kit Title

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-6565
Patch Status
Patched
Published
May 26, 2026

Affected Software

Style Kits for Elementor [analogwp-templates]

Researchers

More Details >

Team Master <= 1.1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8870
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Team Master – A Modern WordPress Team Showcase [team-master]

Researcher

More Details >

Team Showcase <= 1.22.28 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2025-62745
Patch Status
Unpatched
Published
May 25, 2026

Affected Software

Team Showcase [team]

Researcher

More Details >

The Plus Addons for Elementor <= 6.4.15 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘carousel_direction’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-9243
Patch Status
Patched
Published
May 28, 2026

Affected Software

The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce [the-plus-addons-for-elementor-page-builder]

Researcher

More Details >

Tuxquote <= 1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8846
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Tuxquote [tuxquote]

Researcher

More Details >

WP Iframe Geo Style for Amazon affiliates <= 1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘adid’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8837
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

WP Iframe Geo Style for Amazon affiliates [wp-iframe-geo-style-for-amazon-affiliates]

Researcher

More Details >

WPBakery Page Builder Addons by Livemesh <= 3.9.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-2030
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

WPBakery Page Builder Addons by Livemesh [addons-for-visual-composer]

Researcher

More Details >

WPBakery Page Builder Addons by Livemesh <= 3.9.4 – Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-3895
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

WPBakery Page Builder Addons by Livemesh [addons-for-visual-composer]

Researcher

More Details >

WPComplete <= 2.9.5.4 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-42750
Patch Status
Patched
Published
May 29, 2026

Affected Software

WPComplete [wpcomplete]

Researcher

More Details >

Easy Updates Manager <= 9.0.20 – Reflected Cross-Site Scripting via ‘paged’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-7660
Patch Status
Patched
Published
May 27, 2026

Affected Software

Easy Updates Manager [stops-core-theme-and-plugin-updates]

Researcher

More Details >

Felan Framework <= 1.1.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2025-22741
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Felan Framework [felan-framework]

Researcher

More Details >

Gutenverse <= 3.4.6 – Reflected Cross-Site Scripting via ‘s’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-3001
Patch Status
Patched
Published
May 26, 2026

Affected Software

Gutenverse – WordPress Blocks, Page Builder & Site Editor [gutenverse]

Researcher

More Details >

MinhNhut Link Gateway <= 3.6.1 – Reflected Cross-Site Scripting via ‘url’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-3349
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

MinhNhut Link Gateway [minhnhut-link-gateway]

Researcher

More Details >

NS Product icon badge <= 1.2.4 – Reflected Cross-Site Scripting via PHP_SELF

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-8707
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

NS Product icon badge [product-icon-badge]

Researcher

More Details >

SweetDate Core < 1.1.5 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2025-69140
Patch Status
Patched
Published
May 26, 2026

Affected Software

Sweet Date Core [sweetdate-core]

Researcher

More Details >

WP AutoBuzz <= 1.1.1 – Cross-Site Request Forgery to Stored Cross-Site Scripting via ‘googleAccount’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-8911
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

WP AutoBuzz [wp-autobuzz]

Researcher

More Details >

WP Promoter <= 1.3 – Cross-Site Request Forgery to Stored Cross-Site Scripting via ‘popup_width’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-8906
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

WP Promoter [wp-promoter]

Researcher

More Details >

ShopLentor – WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid ‘blockUniqId’ Block Attribute

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-6287
Patch Status
Patched
Published
May 26, 2026

Affected Software

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin [woolentor-addons]

Researcher

More Details >

Accept Stripe Payments <= 2.0.98 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-42752
Patch Status
Patched
Published
May 29, 2026

Affected Software

Accept Stripe Payments [stripe-payments]

Researcher

More Details >

Advanced Custom Fields (ACF®) <= 6.8.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
Patch Status
Patched
Published
May 27, 2026

Affected Software

Advanced Custom Fields (ACF®) [advanced-custom-fields]

Researcher

More Details >

Advanced Custom Fields (ACF®) <= 6.8.1 – Unauthenticated Arbitrary Post Modification via Front-End Form ‘_post_title’ and ‘_post_content’ Parameters

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-8382
Patch Status
Patched
Published
May 30, 2026

Affected Software

Advanced Custom Fields (ACF®) [advanced-custom-fields]

Researcher

More Details >

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.5 – Unauthenticated Denial of Service

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-7493
Patch Status
Patched
Published
May 26, 2026

Affected Software

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin [simply-schedule-appointments]

Researcher

More Details >

Appointment Booking Calendar <= 1.6.11.8 – Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-6937
Patch Status
Patched
Published
May 27, 2026

Affected Software

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin [simply-schedule-appointments]

Researcher

More Details >

Auto Affiliate Links <= 6.8.8.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-24592
Patch Status
Patched
Published
May 25, 2026

Affected Software

Auto Affiliate Links [wp-auto-affiliate-links]

Researcher

More Details >

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.14.16 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-42736
Patch Status
Patched
Published
May 27, 2026

Affected Software

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]

Researcher

More Details >

Breeze Cache <= 2.5.2 – Unauthenticated Exposure of Sensitive Information to an Unauthorized Actor via Crafted Login Cookie

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-2128
Patch Status
Patched
Published
May 28, 2026

Affected Software

Breeze Cache [breeze]

Researcher

More Details >

CloudSecure WP Security <= 1.4.7 – Two-Factor Authentication Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-42411
Patch Status
Patched
Published
May 28, 2026

Affected Software

CloudSecure WP Security [cloudsecure-wp-security]

Researcher

More Details >

Contact Form 7 – PayPal & Stripe Add-on <= 2.4.9 – Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler (‘invoice’/’mc_gross’ Verification)

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9189
Patch Status
Patched
Published
May 28, 2026

Affected Software

Contact Form 7 – PayPal & Stripe Add-on [contact-form-7-paypal-add-on]

Researcher

More Details >

E-cab Taxi Booking Manager for Woocommerce <= 2.0.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-25426
Patch Status
Patched
Published
May 26, 2026

Affected Software

E-cab Taxi Booking Manager for Woocommerce [ecab-taxi-booking-manager]

Researcher

More Details >

ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 3.9.6 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-49053
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor [elementskit-lite]

Researcher

More Details >

Event Booking Manager for WooCommerce <= 5.3.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-45441
Patch Status
Patched
Published
May 26, 2026

Affected Software

Event Booking Manager for WooCommerce [mage-eventpress]

Researcher

More Details >

GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-24546
Patch Status
Patched
Published
May 25, 2026

Affected Software

GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress [gamipress]

Researcher

More Details >

Geo Mashup <= 1.13.19 – Missing Authorization to Unauthenticated Plugin Settings Disclosure via ‘geo_mashup_content’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-7552
Patch Status
Patched
Published
May 27, 2026

Affected Software

Geo Mashup [geo-mashup]

Researcher

More Details >

KiviCare – Clinic & Patient Management System (EHR) <= 4.3.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-42735
Patch Status
Patched
Published
May 26, 2026

Affected Software

KiviCare – Clinic & Patient Management System (EHR) [kivicare-clinic-management-system]

Researcher

More Details >

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.1.8 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-42743
Patch Status
Patched
Published
May 28, 2026

Affected Software

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]

Researcher

More Details >

Mayosis Core <= 5.4.7 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-39655
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Mayosis Core [mayosis-core]

Researcher

More Details >

Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.3.23 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-24590
Patch Status
Patched
Published
May 26, 2026

Affected Software

Paid Videochat Turnkey Site – HTML5 PPV Live Webcams [ppv-live-webcams]

Researcher

More Details >

Quads Ads Manager for Google AdSense <= 3.0.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-42744
Patch Status
Patched
Published
May 28, 2026

Affected Software

Quads Ads Manager for Google AdSense [quick-adsense-reloaded]

Researcher

More Details >

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 – Missing Authorization to Unauthenticated Homepage Settings Modification

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2025-12714
Patch Status
Patched
Published
May 28, 2026

Affected Software

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]

Researchers

More Details >

RSVP and Event Management <= 2.7.16 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-27398
Patch Status
Patched
Published
May 25, 2026

Affected Software

RSVP and Event Management [rsvp]

Researcher

More Details >

Search Analytics for WP < 1.5.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-27357
Patch Status
Patched
Published
May 25, 2026

Affected Software

Search Analytics for WP [search-analytics]

Researcher

More Details >

SePay Gateway <= 1.1.20 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-42763
Patch Status
Patched
Published
May 26, 2026

Affected Software

SePay Gateway [sepay-gateway]

Researcher

More Details >

Smart Online Order for Clover <= 1.6.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-42745
Patch Status
Patched
Published
May 28, 2026

Affected Software

Smart Online Order for Clover [clover-online-orders]

Researcher

More Details >

Smart Online Order for Clover <= 1.6.0 – Unauthenticated Sensitive Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-42746
Patch Status
Patched
Published
May 28, 2026

Affected Software

Smart Online Order for Clover [clover-online-orders]

Researcher

More Details >

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.1.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-25425
Patch Status
Patched
Published
May 28, 2026

Affected Software

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]

Researcher

More Details >

User Registration & Membership <= 5.1.5 – Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via ‘profile-pic-url’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-7651
Patch Status
Patched
Published
May 27, 2026

Affected Software

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]

Researcher

More Details >

WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.10 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-42753
Patch Status
Patched
Published
May 29, 2026

Affected Software

WCFM Membership – WooCommerce Memberships for Multivendor Marketplace [wc-multivendor-membership]

Researcher

More Details >

WP Promoter <= 1.3 – Missing Authorization to Unauthenticated Statistics Reset via wpp-reset_stats AJAX Action

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9014
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

WP Promoter [wp-promoter]

Researcher

More Details >

WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.10.0.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-48835
Patch Status
Patched
Published
May 28, 2026

Affected Software

WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More [wpforms-lite]

Researcher

More Details >

EnvíaloSimple: Email Marketing y Newsletters <= 2.4.5 – Authenticated (Administrator+) SQL Injection via ‘orderby’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-7618
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

EnvíaloSimple: Email Marketing y Newsletters [envialosimple-email-marketing-y-newsletters-gratis]

Researcher

More Details >

Frontend Admin by DynamiApps <= 3.28.28 – Authenticated (Administrator+) SQL Injection via ‘order’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-10039
Patch Status
Patched
Published
May 28, 2026

Affected Software

Frontend Admin by DynamiApps [acf-frontend-form-element]

Researchers

More Details >

myLinksDump <= 1.6 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘link_title’ Parameter

4.8

CVSS Rating
4.8 (Medium)
CVE-ID

CVE-2026-2288
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

myLinksDump [mylinksdump]

Researcher

More Details >

rexCrawler <= 1.0.15 – Authenticated (Administrator+) Stored Cross-Site Scripting via Settings

4.8

CVSS Rating
4.8 (Medium)
CVE-ID

CVE-2026-2280
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

rexCrawler [rexcrawler]

Researcher

More Details >

Meta for WooCommerce <= 3.7.0 – Unauthenticated Open Redirect

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-49059
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

Meta for WooCommerce [facebook-for-woocommerce]

Researcher

More Details >

MinhNhut Link Gateway <= 3.6.1 – Authenticated (Admin+) Stored Cross-Site Scripting via Plugin Settings

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-3348
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

MinhNhut Link Gateway [minhnhut-link-gateway]

Researcher

More Details >

Post Snippets <= 4.0.19 – Authenticated (Administrator+) Stored Cross-Site Scripting via Import

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-7430
Patch Status
Patched
Published
May 28, 2026

Affected Software

Post Snippets – Custom WordPress Code Snippets Customizer [post-snippets]

Researcher

More Details >

3D Viewer <= 2.0.1 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via settings REST endpoint

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8682
Patch Status
Patched
Published
May 27, 2026

Affected Software

3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On [ar-vr-3d-model-try-on]

Researcher

More Details >

Adminimize <= 1.11.11 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-49045
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

Adminimize [adminimize]

Researcher

More Details >

Appointment Booking Plugin for WooCommerce – WpBookingly | All-in-One Service Manager <= 1.2.9 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-25444
Patch Status
Patched
Published
May 26, 2026

Affected Software

Appointment Booking Plugin for WooCommerce – WpBookingly | All-in-One Service Manager [service-booking-manager]

Researcher

More Details >

auto making JSON-LD <= 4.5.3 – Cross-Site Request Forgery to Plugin Certification Settings via Nonce Validation Bypass

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8938
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

auto making JSON-LD [auto-making-json-ld]

Researcher

More Details >

Autoship Cloud for WooCommerce Subscription Products <= 2.14.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-24527
Patch Status
Unpatched
Published
May 25, 2026

Affected Software

Autoship Cloud for WooCommerce Subscription Products [autoship-cloud]

Researcher

More Details >

Brikk <= 3.0.0 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2025-69103
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Brikk – Directory & Listing WordPress Theme [brikk]

Researcher

More Details >

CDN Linker lite <= 1.3.1 – Cross-Site Request Forgery to Plugin Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8941
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

CDN Linker lite [ossdl-cdn-off-linker]

Researcher

More Details >

cformsII <= 15.1.3 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-39436
Patch Status
Patched
Published
May 25, 2026

Affected Software

cformsII [cforms2]

Researcher

More Details >

CM Ad Changer <= 2.0.7 – Cross-Site Request Forgery to Campaign Deletion via Campaign Management

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9236
Patch Status
Patched
Published
May 26, 2026

Affected Software

CM Ad Changer – A simple tool to control and optimize your site’s banners [cm-ad-changer]

Researcher

More Details >

DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.4.28 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-49047
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer [3d-flipbook-dflip-lite]

Researcher

More Details >

Easy Digital Downloads <= 3.6.7 – Cross-Site Request Forgery to Payment Account Hijacking via ‘square_tokens’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-7533
Patch Status
Patched
Published
May 27, 2026

Affected Software

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]

Researcher

More Details >

ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 3.9.6 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-49052
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor [elementskit-lite]

Researcher

More Details >

Equalize Digital Accessibility Checker <= 1.42.0 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Accessibility Issue Modification via edac_insert_ignore_data AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9015
Patch Status
Patched
Published
May 27, 2026

Affected Software

Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance [accessibility-checker]

Researcher

More Details >

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 – Missing Authorization to Authenticated (Subscriber+) Email Sending

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-4888
Patch Status
Patched
Published
May 27, 2026

Affected Software

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder [everest-forms]

Researcher

More Details >

Export WordPress Pages to Static HTML & PDF — Static Site Export <= 6.0.0 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-24574
Patch Status
Patched
Published
May 25, 2026

Affected Software

Export WordPress Pages to Static HTML & PDF — Static Site Export [export-wp-page-to-static-html]

Researcher

More Details >

Feeds for TikTok – Display Video Feeds in Grid Layouts <= 1.0.24 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-24520
Patch Status
Patched
Published
May 26, 2026

Affected Software

Feeds for TikTok – Display Video Feeds in Grid Layouts [b-tiktok-feed]

Researcher

More Details >

FlexTable – Data Table Sync with Google Sheets <= 3.24.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-24582
Patch Status
Unpatched
Published
May 25, 2026

Affected Software

FlexTable – Data Table Sync with Google Sheets [sheets-to-wp-table-live-sync]

Researcher

More Details >

FOX – Currency Switcher Professional for WooCommerce <= 1.4.6 – Authenticated (Subscriber+) Authorization Bypass via User-Controlled Key to ‘wooc_order_user_roles’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9241
Patch Status
Patched
Published
May 27, 2026

Affected Software

FOX – Currency Switcher Professional for WooCommerce [woocommerce-currency-switcher]

Researcher

More Details >

Genemy – Creative Minimal Landing Page Builder for Digital Startup Design Studio Agency in Marketing <= 1.6.6 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2025-69137
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Genemy – Creative Minimal Landing Page Builder for Digital Startup Design Studio Agency in Marketing [genemy]

Researcher

More Details >

GenerateBlocks <= 2.1.0 – Authenticated (Contributor+) Information Disclosure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-48877
Patch Status
Patched
Published
May 27, 2026

Affected Software

GenerateBlocks [generateblocks]

Researcher

More Details >

Genzel breadcrumbs <= 1.2 – Cross-Site Request Forgery to Settings Update via Plugin Settings Page

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8708
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Genzel breadcrumbs [genzel-breadcrumbs]

Researcher

More Details >

GoStats for WordPress <= 1.4 – Cross-Site Request Forgery via gostats_manage() Function

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8943
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

GoStats for WordPress [gostats-for-wordpress]

Researcher

More Details >

JobCareer <= 7.3 – Authenticated (Subscriber+) Arbitrary File Deletion

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2025-69128
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

JobCareer [jobcareer]

Researcher

More Details >

MetaMagic SEO Plugin <= 1.6 – Cross-Site Request Forgery to Plugin Settings Update via Settings Page

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8942
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

MetaMagic SEO Plugin [metamagic]

Researcher

More Details >

NanoCare < 1.2.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-32389
Patch Status
Patched
Published
May 25, 2026

Affected Software

Home Health Care, Medical Care WordPress Theme – NanoCare [nanocare]

Researcher

More Details >

Newses <= 2.0.0.77 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-24586
Patch Status
Unpatched
Published
May 25, 2026

Affected Software

Newses [newses]

Researcher

More Details >

Old Posts Highlighter <= 1.0.3 – Cross-Site Request Forgery to Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-7614
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Old Posts Highlighter [old-posts-highlighter]

Researcher

More Details >

Organization chart <= 1.7.5 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-24597
Patch Status
Patched
Published
May 25, 2026

Affected Software

Organization chart [organization-chart]

Researcher

More Details >

PDF Embedder <= 4.9.3 – Authenticated (Contributor+) Information Exposure via Block Editor Page

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-7526
Patch Status
Patched
Published
May 27, 2026

Affected Software

PDF Embedder [pdf-embedder]

Researcher

More Details >

PeachPay <= 1.120.46 – Cross-Site Request Forgery to Stripe Unlink

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9618
Patch Status
Patched
Published
May 27, 2026

Affected Software

PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) [peachpay-for-woocommerce]

Researcher

More Details >

Poll Maker by AYS <= 6.3.7 – Authenticated (Subscriber+) Sensitive Information Exposure in ‘ays_poll_get_user_information’ AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8995
Patch Status
Patched
Published
May 28, 2026

Affected Software

Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls [poll-maker]

Researcher

More Details >

Product Import Export for WooCommerce – Import Export Product CSV Suite <= 2.5.6 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-48971
Patch Status
Patched
Published
May 27, 2026

Affected Software

Product Import Export for WooCommerce – Import Export Product CSV Suite [product-import-export-for-woo]

Researcher

More Details >

QR Redirector <= 2.0.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-24545
Patch Status
Patched
Published
May 25, 2026

Affected Software

QR Redirector [qr-redirector]

Researcher

More Details >

RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1121 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-24638
Patch Status
Patched
Published
May 26, 2026

Affected Software

RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress [computer-repair-shop]

Researcher

More Details >

Search Simple Fields <= 0.2 – Cross-Site Request Forgery to Plugin Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8939
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Search Simple Fields [search-simple-fields]

Researcher

More Details >

SMTP2GO for WordPress <= 1.16.0 – Missing Authorization to Authenticated (Subscriber+) Log Read/Truncate

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-7621
Patch Status
Patched
Published
May 27, 2026

Affected Software

SMTP2GO for WordPress – Email Made Easy [smtp2go]

Researcher

More Details >

Subscription & Recurring Payment for WooCommerce <= 1.9.1 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-24554
Patch Status
Patched
Published
May 25, 2026

Affected Software

Subscription & Recurring Payment for WooCommerce [subscription]

Researcher

More Details >

Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.6.7 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-42776
Patch Status
Patched
Published
May 26, 2026

Affected Software

Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart]

Researcher

More Details >

SVG Support <= 2.5.14 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-48973
Patch Status
Patched
Published
May 27, 2026

Affected Software

SVG Support [svg-support]

Researcher

More Details >

The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.9.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-49054
Patch Status
Unpatched
Published
May 27, 2026

Affected Software

The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid [the-post-grid]

Researcher

More Details >

Timetable and Event Schedule by MotoPress <= 2.4.16 – Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data Function

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9228
Patch Status
Patched
Published
May 27, 2026

Affected Software

Timetable and Event Schedule by MotoPress [mp-timetable]

Researcher

More Details >

Travelly – Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Solution <= 2.1.5 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-27331
Patch Status
Patched
Published
May 26, 2026

Affected Software

Travelly – Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Solution [tour-booking-manager]

Researcher

More Details >

Two-factor authentication (formerly IP Vault) <= 2.1 – Cross-Site Request Forgery to Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8903
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Two-factor authentication (formerly IP Vault) [ip-vault-wp-firewall]

Researcher

More Details >

Visualizer: Tables and Charts Manager for WordPress <= 3.11.14 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Chart Creation and Modification via renderChartPages() and uploadData() Functions

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8689
Patch Status
Patched
Published
May 27, 2026

Affected Software

Visualizer: Tables and Charts Manager for WordPress [visualizer]

Researcher

More Details >

Woocommerce Envato Affiliates <= 1.2.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2025-14361
Patch Status
Unpatched
Published
May 26, 2026

Affected Software

Woocommerce Envato Affiliates [wooenvato]

Researcher

More Details >

WP Meta and Date Remover <= 2.3.6 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-49051
Patch Status
Patched
Published
May 27, 2026

Affected Software

WP Meta and Date Remover [wp-meta-and-date-remover]

Researcher

More Details >

Yoast SEO <= 26.5 – Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via ‘post_id’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2025-14481
Patch Status
Patched
Published
May 26, 2026

Affected Software

Yoast SEO – Advanced SEO with real-time guidance and built-in AI [wordpress-seo]

Researcher

More Details >

Disable Comments & Delete All Comments <= 1.3.0 – Missing Authorization

3.1

CVSS Rating
3.1 (Low)
CVE-ID

CVE-2026-42749
Patch Status
Patched
Published
May 29, 2026

Affected Software

Disable Comments & Delete All Comments [comments-plus]

Researcher

More Details >

B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More < 5.2.10 – Missing Authorization

2.7

CVSS Rating
2.7 (Low)
CVE-ID

CVE-2026-27346
Patch Status
Patched
Published
May 25, 2026

Affected Software

B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More [b2bking-wholesale-for-woocommerce]

Researcher

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (May 25, 2026 to May 31, 2026) appeared first on Wordfence.

]]>